Privacy Policy B2B Connect
1. General information on data protection
We appreciate you visiting our website (https://b2bconnect.mercedes-benz.com/cy) and the use of our services offered through it as well as your associated interest in our offers. Protecting your personal data is very important to us. In this Privacy Policy, we explain how we collect your personal data, what we do with it, for what purposes and on what legal basis this is done, and what rights and claims are associated with it for you. In addition, we refer to the Mercedes-Benz Data Protection Policy:
Mercedes-Benz Data Protection Policy.
Our Privacy Policy for the use of our websites and the Mercedes-Benz Data Protection Policy do not apply to your activities on the websites of social networks or other providers that can be accessed using the links on our websites. Please read in this regard the data protection provisions on the websites of those providers.
2. Name and contact details of the Controller, Data Protection Officer
2.1 CYPRUS IMPORT CORPORATION LTD (CiC) as Controller
CYPRUS IMPORT CORPORATION LIMITED ("CIC Ltd.", "we" or "us") a limited liability company organized and existing under the laws of Cyprus, registered with Cyprus Registrar of Companies, Nicosia, Cyprus, under registration number HE463, having its principal place of business at 65/67 Kantaras Avenue, 1017 Cyprus
Data Protection Officer
CYPRUS IMPORT CORPORATION LIMITED
2.2 Joint Controllership with Mercedes-Benz AG
In addition, CIC Ltd. and
Mercedes-Benz AG ("MBAG")
Mercedesstr. 120
70372 Stuttgart
Germany
Email: dialog@mercedes-benz.com
Data Protection Officer:
Mercedes-Benz Group AG
Group Data Protection Officer
HPC E600
D-70546 Stuttgart
Germany
Email: data.protection@mercedes-benz.com
and
partly also the dealers participating in B2B Connect
are for individual processing operations via this website joint controllers. This concerns the processing of personal data on the one hand for services integrated via our websites (section 3.5) and on the other hand the performance of standardised sales and aftersales market analyses (section 3.6).
In this context, we, MBAG and partially also the dealers have made special arrangements for data transmission and processing in order to set out the use of personal data for these specific purposes. In this context, MBAG provides the respective central systems (in some cases only by way of processing on behalf), coordinates central data processing at the market or cross-market level and also uses the personal data stored in central systems for its own business purposes (e.g. market analyses) if there is a corresponding legal basis, while we provide the respective systems to you as part of sales or aftersales activities.
Upon request, we will provide you with a description of the material provisions of this agreement between us and MBAG (and dealers, if applicable) to the extent provided by law. Data subject requests should generally be addressed to us. However, you remain entitled to assert your data subject rights with regard to the aforementioned processing also against MBAG, or dealers (where applicable).
3. Collection and processing of your personal data
3.1 Website visit for informational purposes
Whenever you visit our websites, we store certain information about the browser and operating system you are using, the date and time of your visit, the access status (e.g. whether you were able to access a website or received an error message), the usage of features on the website, any search terms you entered, how often you visit individual websites, the name of files you access, the amount of data transferred, the web page from which you accessed our website and the web page you visit after visiting our website, whether by clicking links on our websites or by entering a domain directly in the input field of the same tab (or window) of your browser in which you opened our websites.
In addition, we store your IP address and the name of your internet service provider for seven days for security reasons, in particular to prevent and detect attacks on our websites or attempts at fraud.
The legal basis for this processing is our legitimate interest in being able to display our websites as well as data protection control and data security (Art. 6 para. 1 s.1 f) GDPR).
The personal data set out in this section is automatically collected by our IT systems when you visit our websites. Without the processing of that personal data, a website may not be displayed optimally.
3.2 Contact via online contact form, chat
If you contact us via our website, your details from the online contact form or chat will be processed by us for the purpose of processing the enquiry, the associated technical administration and in the event that follow-up questions arise.
Personal data that we process in this context is contact details provided (name, telephone number, address, reason for contact, etc.) and your email address.
The legal basis for the processing of this data is, in the case of (pre-)contractual measures, the processing of the contract (Art. 6 para. 1 s.1 b) GDPR), otherwise the mutual interest in processing (Art. 6 para. 1 s. 1 f) GDPR).
If you provide us with further personal data via a contact form or chat, we will use this data for the aforementioned purposes, for customer administration purposes and - if necessary - for the purposes of processing and invoicing any business transactions, in each case to the extent required for this purpose.
Insofar as we are obliged under the applicable law to retain certain personal data for legally defined periods of time (such as in connection with business incidents), we will continue to store this personal data for as long as is necessary (Art. 6 para. 1 s.1 c) GDPR). Your personal data will be deleted immediately when it is no longer required for the purposes of fulfilling the legal obligations.
We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data (with the exception of any voluntary information), it is not possible to provide the services set out in this section.
3.3 Registration, use of B2B Connect for product views and orders
In case of an order or other contract-related processing, we use your personal data to process or handle the order and other contract-related enquiries. The processing may also be conducted to resolve disputes or enforce the contractual agreement.
Personal data that we process in this context is registration data ("UMAS registration data", more detailed information on this is provided in the UMAS data protection policy [https://aftersales.mercedes-benz.com/umas/login/#/]), order communication data, order data (product, quantity, etc.), payment data (all required billing information).
In case of products from WebParts, this data is forwarded to the WebParts shop, insofar as this data is already entered on these websites. Further information on this is provided in the WebParts data protection policy [https://webparts.online-help.solutions/cust/be/en_us/faq].
In case of After Sales Applications and Data Content, this data will also be forwarded to MBAG for further order and contract processing. The specific information regarding the use of personal data for the After Sales Applications and Data Content is provided in the respective data protection policy provided upon conclusion of the contract.
In case of contractual measures, the legal basis for the processing of this data is the performance of the contract (Art. 6 para. 1 s.1 b) GDPR). Insofar as we are obliged under the applicable law to retain certain personal data for legally defined periods of time (such as in connection with business incidents), we will continue to store this personal data for as long as is necessary (Art. 6 para. 1 s.1 c) GDPR). Your personal data will be deleted immediately when it is no longer required for the purposes of fulfilling the legal obligations.
We collect the personal data set out in this section directly from you by you having provided the personal data yourself or by the system pulling it (e.g. from UMAS). Without processing the personal data, it is not possible to provide the services set out in this section.
3.4 Participation in surveys, price competitions
Insofar as you participate in surveys or price competitions offered via our website, we also use personal data from you in order to conduct these.
Personal data that we process in this context is UMAS registration data, and other information that you provide in this context.
The legal basis for the processing of this data is the performance of the contract with regard to all necessary information (Art. 6 para. 1 s.1 b) GDPR), for all other information the mutual interest (Art. 6 para. 1 s.1 f) GDPR).
If we (and possibly selected third parties) use your personal data for further purposes (e.g. display of personalised content or advertising based on your usage behaviour), the legal basis is your consent (Art. 6 para. 1 s.1 a) GDPR) via our Consent Management System. You can obtain further information and decision-making options here: https://www.mercedes-benz.com.cy/passengercars/contentpool/tool-pages/legal/privacy-statement.html.
We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.
3.5 Other services integrated via the websites
In addition, we jointly use the personal data set out below with MBAG (and the dealers, if applicable) in order to provide you with certain services/dashboard views in connection with WebParts and the After Sales Applications and Data Content via our websites.
a. Create vehicles
The "Create Vehicle" application enables you to manage a vehicle on the basis of its vehicle identification number (“FIN/VIN”) in order to simplify the use of the after sales services (including the search for vehicle spare parts and information on repair instructions, retrofitting options, fault diagnosis keys and other checklists as well as information on working hours, prices (incl. agreed conditions, if applicable) service packages and supplementary information in order to provide a precise cost estimate and efficient repair implementation, access to the Digital Service Booklet), for which further information is provided in the respective data protection policies.
In order to create and display specific vehicles in this application, the processing of your end customer's FIN/VIN and your UMAS registration data is required which can be selected during the process.
The legal basis for the processing of this data is the performance of the contract with regard to all necessary information (Art. 6 para. 1 s.1 b) GDPR), for all other information the mutual interest (Art. 6 para. 1 s.1 f) GDPR).
We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.
b. Order history / dealer / account
Furthermore, we enable you to view via our websites (i) which products have been purchased by you via WebParts and in the form of After Sales Applications and Data Content (including how long they will remain available), (ii) which dealers you have selected and (iii) which other users are registered for your organisation.
The use requires the processing of your UMAS registration data as well as the registration data of other users of your organisation and your order information.
The legal basis for the processing of this data is the performance of the contract (Art. 6 para. 1 s.1 b) GDPR).
We collect the personal data set out under this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.
c. B2B Connect Seller Center
Upon request you may decide to let pre-selected dealers support you with complaints or other requests concerning a transaction via the platform through the B2B Connect Seller Center (“Seller Center”). Subject to your prior confirmation, a selected dealer may receive access to your service requests (e.g. tickets) in order to provide support. Such a support is provided only in the relationship between you and the respective dealer and occurs exclusively under the responsibility of the latter who is acting as a controller in the meaning of the GDPR. The legal basis for allowing the dealer to access the relevant data is the legitimate interest to allow for a most efficient operation of the services and their use by you (Art. 6 para. 1 s.1 f) GDPR).
d. 5*Rater
In addition, an evaluation tool is made available to you for evaluating the performance of the dealers via WebParts as well as these websites.
This is intended to improve the performance of the dealers and these websites. When you use the 5*Rater, the order number and order status (if related to a product) as well as your UMAS registration data and feedback are processed. This data will also be passed on to the dealers so that they can contact you if necessary in order to implement your feedback accordingly.
The legal basis for the processing of this data is a direct implementation of your feedback as performance of contract comprehending the 5*Rater as a voluntary service (Art. 6 para. 1 s.1 b) GDPR), possibly also your consent (Art. 6 para. 1 s.1 a) GDPR) by means of our Consent Management System, if the data is used for purposes of internal analysis. You can obtain further information and decision-making options here: https://www.mercedes-benz.com.cy/passengercars/content-pool/tool-pages/legal/privacy-statement.html.
We collect the personal data set out under this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.
3.6 Business analyses and marketing campaigns
For market research and internal business analysis purposes, dealers and we provide MBAG with specific data relating to aftersales service transactions via WebParts, including invoice number, or parts/services that have not been sold (“lost sales”), FIN/VIN, dealer ID, information on products, parts or services sold, registration number (UK only), first registration and mileage of a vehicle.
When processing the data, it may be supplemented by other information known to MBAG about the transmitted vehicle, its model, series, equipment or its parts and components. As a rule, this processing is carried out to improve the quality of the data transmitted by the dealer (e.g. addition of the date of first registration if the dealer has not entered this).
The transmitted data may also be used by MBAG in anonymised form for other processing purposes, such as statistical and analysis purposes.
a. Business analyses
Based on the data provided, MBAG performs customary aftersales and business analytics evaluations for further use by the respective dealers and us (e.g. to determine how many products of a certain type have been sold in a country or to validate pricing models). MBAG employees engaged in these tasks are not able to attribute the data provided to any natural person. The results produced as part of these tasks are limited to aggregated reports that do not contain any personal data. MBAG and its employees operate strictly in accordance with the need-to-know principle and have implemented specific safeguards to ensure the processing of such data in accordance with its stated purposes.
The legal basis for this type of processing is the legitimate interests of us, the dealers and MBAG (Art. 6 para. 1 s.1 f) GDPR), which is to operate the most efficient sales systems possible. The lawfulness of the processing for the business analyses forms the legitimate interest of us, the dealers and MBAG (Art. 6 para. 1 s.1 f) GDPR), which consists in improving the effectiveness of sales and internal business processes.
b. Marketing campaigns
In some markets, MBAG may process the above data to assist dealers and us in conducting direct marketing campaigns. MBAG may also centrally manage and send relevant marketing campaigns and materials to end customers in the name of and on behalf of the aforementioned. In some markets we may provide similar services to dealers.
All these activities are carried out exclusively on behalf of the dealers and us (if applicable, data processing on behalf pursuant to Art. 28 GDPR).
We collect the personal data set out in this section directly from you by you having provided the personal data yourself or indirectly from your activities on our websites.
3.7 Newsletter
If you subscribe to a newsletter offered on our websites, the data provided when registering for the newsletter will be used solely for the purpose of mailing the newsletter, unless you consent to its use for additional purposes. You may unsubscribe at any time by using the unsubscribe option provided in the newsletter.
To register, you must provide us with your email address. You can voluntarily provide us with additional information, such as your name. The registration takes place in a so-called double opt-in procedure. After registration, you will receive a confirmation email from us in which you must confirm the registration again. This entire process is documented and stored. This includes the storage of the registration and confirmation time as well as your IP address.
The legal basis for the processing of personal data in connection with the sending of the newsletter is your consent (Art. 6 para. 1 s.1 a) GDPR).
You can revoke your consent to the processing of your personal data in connection with the sending of the newsletter at any time by cancelling the newsletter. For this purpose, please use the provided link at the end of the newsletter to cancel. The legality of the data processing already carried out remains unaffected by the revocation.
3.8 Use due to legal obligation
In addition, we use your personal data if we are legally obliged to do so (e.g. storage to comply with commercial or tax retention obligations, disclosure in accordance with official or court orders, e.g. to a law enforcement agency).
In this case, the legal basis for the processing of personal data is the fulfilment of legal requirements (Art. 6 para. 1 s.1 c) GDPR). Your personal data will be deleted immediately if it is no longer required for the fulfilment of legal obligations.
4. Transfer of personal data to third parties; social plug-ins; use of service providers
a. Our websites may also contain offers from third parties. When you click on such an offer, we transmit data to the respective provider to the extent necessary (e.g. the information that you found this offer on our website and, if applicable, further information that you have already provided for this purpose on our websites).
b. If we use so-called "social plug-ins" from social networks such as Facebook and Twitter on our websites, we integrate these as follows:
When you visit our websites, the social plug-ins are deactivated, i.e. no data is transmitted to the operators of these networks. If you wish to use one of the networks, click on the respective social plug-in to establish a direct connection with the server of the respective network.
If you have a user account with the network and are logged in at the time the social plug-in is activated, the network can assign your visit to our website to your user account. If you wish to avoid this, please log out of the network before activating the social plug-in. A social network cannot associate a visit to other (Mercedes-Benz) websites with your user account unless you have also activated a social plug-in there.
When you activate a social plug-in, the network transmits the content that becomes available as a result directly to your browser, which integrates it into our websites. In this situation, data transfers may also take place that are initiated and controlled by the respective social network. Your connection to a social network, the data transfers that take place between the network and your system and your interactions on this platform are governed exclusively by the data protection policies of the respective network.
The social plug-in remains active until you deactivate it or delete your cookies (see section 5.d).
The legal basis for this type of processing on our websites is our legitimate interest (Art. 6 para. 1 s.1 f) GDPR), which is to enable you to use the social plug-ins, which you indicate by clicking on them.
c. When you click on the link to an offer or activate a social plug-in, personal data may be transferred to providers in countries outside the European Economic Area which, from the perspective of the European Union ("EU"), do not ensure an "adequate level of protection" for the processing of personal data in line with EU standards. Please bear this in mind before clicking on a link or activating a social plugin and thereby triggering a transfer of your data.
d. We also use qualified service providers (e.g. IT service providers, marketing agencies) to operate, optimise and secure our websites. We only forward personal data to them insofar as this is necessary for the provision and use of the websites and their functionalities, for the pursuit of legitimate interests (both Art. 6 para. 1 s.1 f) GDPR), for the fulfilment of legal obligations (Art. 6 para. 1 s.1 c) GDPR) or insofar as you have consented to this (Art. 6 para. 1 s.1 a) GDPR). You can find more details on the recipients (in case of consent) in our Consent Management System: https://www.mercedes-benz.com.cy/passengercars/content-pool/tool-pages/legal/privacy-statement.html.
5. Cookies
a. Cookies may be used when visiting our websites. Technically, these are so-called HTML cookies and similar software tools such as web/DOM storage or local shared objects (so-called "flash cookies"), which we refer to collectively as cookies.
b. Cookies are small files that are stored on your desktop, notebook or mobile device when you visit a website. From these, it is possible to recognise, for example, whether there has already been a connection between the device and the websites, to take into account your preferred language or other settings, to offer you certain functionalities (e.g. online shop, vehicle configurator) or to recognise your interests on a usage basis. Cookies may also contain personal data.
c. Whether and which cookies are used when you visit our websites depends on which areas and functions of our websites you use and whether you consent to the use of cookies that are not technically necessary in our Consent Management System. For more information and decision-making options, please click here: https://www.mercedes-benz.com.cy/passengercars/content-pool/tool-pages/legal/privacy-statement.html.
d. The use of cookies also depends on the settings of the web browser you use (e.g. Microsoft Edge, Google Chrome, Apple Safari, Mozilla Firefox). Most web browsers are preset to automatically accept certain types of cookies; however, you can usually change this setting. You can delete existing cookies at any time. You can delete web/DOM storage and Local Shared Objects separately. You can find out how this works in the browser or device you are using in the provider's instructions.
e. Consent (= approval) to cookies as well as rejection or deletion of cookies are linked to the device used and also to the web browser used in each case. If you use several devices or web browsers, you can make the decisions or settings differently in each case.
f. If you decide against the use of cookies or delete them, it is possible that not all functions of our websites or individual functions will only be available to you to a limited extent.
6. No obligation to provide
The provision of personal data by the data subjects (you, end customers) is generally voluntary. In principle, there is neither a legal nor a contractual obligation on the part of the data subjects to provide the data. However, in the event of non-provision of personal data (such as the FIN/VIN), it may be that individual services or parts thereof cannot be provided or cannot be provided properly. In individual cases, the provision may even be required by law (e.g. in the case of mandatory recalls).
7. Security
We use technical and organisational security measures in order to protect your data we have under our control/managed by us against manipulation, loss, destruction and against access by unauthorised persons. We continuously improve our security measures in line with technological developments.
8. Deletion of your personal data
Your IP address and the name of your internet service provider, which we store for security reasons, are deleted after seven days as described above. Storage beyond this period is possible. In this case, the IP addresses are deleted or alienated so that it is no longer possible to assign the calling client.
Otherwise, we delete your personal data as soon as the purpose for which we collected and processed the data no longer applies. Beyond this time period, data storage only takes place to the extent made necessary by the legislation, regulations or other legal provisions to which we are subject in the EU or by legal provisions in third-party countries if these have an appropriate level of data protection. Should it not be possible to delete data in individual cases, the relevant personal data are flagged to restrict their further processing.
9. Data subjects' rights
a. As a data subject (person) affected by data processing, you have the right to information (Art. 15 GDPR), correction (Art. 16 GDPR), data deletion (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).
b. If you have consented to the processing of your personal data by us, you have the right to revoke your consent at any time. The lawfulness of the processing of your personal data until revocation is not affected by the revocation. Likewise, further processing of this data on the basis of another legal basis, such as for the fulfilment of legal obligations, remains unaffected.
c. Right to object:
You have the right to object at any time, for reasons relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6 para 1 s.1 e) GDPR (data processing in the public interest) or Art. 6 para. 1 s.1 f) GDPR (data processing on the basis of a balance of interests). If you object, we will only continue to process your personal data if we can demonstrate compelling legitimate grounds for doing so that override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims. If we process your personal data for the purpose of direct marketing to protect legitimate interests on the basis of a balance of interests, you also have the right to object to this at any time without giving reasons.
d. We ask you to send your claims or explanations to the following contact address if possible: dialog@mercedes-benz.com
e. If you believe that the processing of your personal data violates legal requirements, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR).
10. Automated decisions
We will not use your personal data to make automated decisions (including profiling) about you that have legal effect on you or similarly significantly affect you.
11. Mercedes-Benz AG Central Access Service
With the Central Registration Service offered by Mercedes-Benz AG, you can sign up for every website and application belonging to the Mercedes-Benz Group and its brands that are connected to the service. The applicable terms of use contain specific data protection provisions. Those terms of use can be found on the registration pages of affiliated websites and applications.
12. Data transfer to recipients (outside the European Economic Area)
12.1. Recipients in general
We share your personal data with the following recipients:
a. We use processors to process personal data for the above purposes, who process the personal data on our behalf. We retain control over the respective personal data and remain the data controller.
b. For payment processing in the course of orders, we transmit payment details to banks or payment service providers if required by the payment method.
c. In individual cases, we may, at your request, share the personal data required for the order with our international representative offices (other companies in the group of companies). Unless there is an adequacy decision of the European Commission for the respective third country outside the European Economic Area, this is done for the performance of a contract (on the basis of Art. 49 para. 1 b) GDPR).
d. We transmit personal data in individual cases to courts, law enforcement agencies, supervisory authorities, other authorities, tax advisors and lawyers if this is legally permissible and necessary.
12.2 Recipients outside the European Economic Area
a. When using service providers (see section 4. d.) and passing on data with your consent (= approval) to third parties (see for example section 5), personal data may be transferred to recipients in countries outside the European Union ("EU"), Iceland, Liechtenstein and Norway (= European Economic Area) and processed there, in particular USA, India.
b. In the following countries, there is an adequate level of protection for the processing of personal data from the EU's perspective (so-called adequacy decision): Andorra, Argentina, Canada (limited), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay. With recipients in other countries, we agree to apply EU standard contractual clauses, binding corporate rules to provide an "adequate level of protection" in accordance with legal requirements. We will be happy to provide you with information on this via the contact details mentioned in point 9.d. above.
Status: February 2023
