Privacy Policy B2B Connect

1. General information on data protection

We appreciate you visiting our website and your interest in our products and services. We attach great importance to the protection of your per-sonal data. In this data protection information we explain how we collect your personal data, what we do with it, for what purposes and on what legal basis this takes place, and what rights and entitlements this entails for you. We additionally refer to the Mercedes-Benz Data Protection Policy:

Mercedes-Benz Data Protection Policy.

Our Privacy Policy for the use of our websites and the Mercedes-Benz Data Protection Policy do not apply to your activities on the websites of social networks or other providers that can be accessed using the links on our websites. Please obtain information about the respective data protection regulations on the websites of said providers.

2. Name and contact details of the Controller, Data Protection Officer

2.1 Controllers

Mercedes-Benz UK Limited (Company No. 2448457) whose registered office is at Tongwell, Milton Keynes, MK15 8BA (“MBUK”);

Data Protection Coordinator
Mercedes-Benz Group UK Ltd
Legal Department Tongwell
Milton Keynes
MK15 8BA
Email: dialog@mercedes-benz.com

2.2 Joint Controllership with Mercedes-Benz AG

In addition, MBUK and

Mercedes-Benz AG ("MBAG")
Mercedesstr. 120
70372 Stuttgart
Germany
email: dialog@mercedes-benz.com

Data Protection Officer:
Mercedes-Benz Group AG

Group Data Protection Officer
HPC E600
D-70546 Stuttgart
Germany
E-mail: data.protection@mercedes-benz.com

And

partly also Mercedes-Benz authorized service partners (hereinafter also “Dealers”) participating in B2B Connect are for individual pro-cessing operations via this website joint controllers. This concerns the processing of personal data on the one hand for services inte-grated via our websites (section 3.5) and on the other hand the per-formance of standardised sales and aftersales market analyses (sec-tion 3.6).

In this context, we, MBAG and partially also the Dealers have made special arrangements for data transmission and processing in order to set out the use of personal data for these specific purposes. In this context, MBAG provides the respective central systems (in some cases only by way of processing on behalf), coordinates central data processing at the market or cross-market level and also uses the per-sonal data stored in central systems for its own business purposes (e.g. market analyses) if there is a corresponding legal basis, while we provide the respective systems to you as part of sales or aftersales activities.

Upon request, we will provide you with a description of the material provisions of this agreement between us and MBAG (and dealers, if applicable) to the extent provided by law. Data subject requests should generally be addressed to us. However, you remain entitled to assert your data subject rights with regard to the aforementioned pro-cessing also against MBAG, or dealers (where applicable).

3. Collection and processing of your personal data

3.1     Website visit for informational purposes

Whenever you visit our websites, we store certain information about the browser and operating system you are using, the date and time of your visit, the access status (e.g. whether you were able to access a website or received an error message), the usage of features on the website, any search terms you entered, how often you visit individual websites, the name of files you access, the amount of data transferred, the web page from which you accessed our website and the web page you visit after visiting our website, whether by clicking links on our websites or by entering a domain directly in the input field of the same tab (or window) of your browser in which you opened our websites. In addition, we store your IP address and the name of your internet service provider for seven days for security reasons, in particular to prevent and detect attacks on our websites or attempts at fraud.

The legal basis for this processing is our legitimate interest in being able to display our websites as well as data protection control and data security (Art. 6 para. 1 s.1 f) GDPR).

The personal data set out in this section is automatically collected by our IT systems when you visit our websites. Without the processing of that personal data, a website may not be displayed optimally.

3.2     Contact via online contact form, chat

If you contact us via our website, your details from the online contact form or chat will be processed by us for the purpose of processing the enquiry, the associated technical administration and in the event that follow-up questions arise.

Personal data that we process in this context is contact details provided (name, telephone number, address, reason for contact, etc.) and your email address.

The legal basis for the processing of this data is, in the case of (pre-)contractual measures, the processing of the contract (Art. 6 para. 1 s.1 b) GDPR), otherwise the mutual interest in processing (Art. 6 para. 1 s. 1 f) GDPR).

If you provide us with further personal data via a contact form or chat, we will use this data for the aforementioned purposes, for customer administration purposes and - if necessary - for the purposes of processing and invoicing any business transactions, in each case to the extent required for this purpose.

Insofar as we are obliged under the applicable law to retain certain personal data for legally defined periods of time (such as in connection with business incidents), we will continue to store this personal data for as long as is necessary (Art. 6 para. 1 s.1 c) GDPR). Your personal data will be deleted immediately when it is no longer required for the purposes of fulfilling the legal obligations.

We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data (with the exception of any voluntary information), it is not possible to provide the services set out in this section.

3.3     Registration, use of B2B Connect for product views and orders

In case of an order or other contract-related processing, we use your personal data to process or handle the order and other contract-related enquiries. The processing may also be conducted to resolve disputes or enforce the contractual agreement.

Personal data that we process in this context is registration data ("UMAS registration data", more detailed information on this is provided in the UMAS data protection policy https://umas.mercedes-benz.com/orgprocess/, order communication data, order request or part selection data (product, quantity, etc., including the vehicle identification number (“FIN/VIN”) of your end customer), payment data (all required billing information).

The data is forwarded to Dealers with whom you interact via B2B Connect. Dealers may process the data in other MB X or MBAG operated systems in order to manage the customer relationship with you.

In case of After Sales Applications and Data Content, this data will also be forwarded to MBAG for further order and contract processing. The specific information regarding the use of personal data for the After Sales Applications and Data Content is provided in the respective data protection policy provided upon conclusion of the contract.

In case of contractual measures, the legal basis for the processing of this data is the performance of the contract (Art. 6 para. 1 s.1 b) GDPR). Insofar as we are obliged under the applicable law to retain certain personal data for legally defined periods of time (such as in connection with business incidents), we will continue to store this personal data for as long as is necessary (Art. 6 para. 1 s.1 c) GDPR). Your personal data will be deleted immediately when it is no longer required for the purposes of fulfilling the legal obligations.

We collect the personal data set out in this section directly from you by you having provided the personal data yourself or by the system pulling it (e.g. from UMAS). Without processing the personal data, it is not possible to provide the services set out in this section.

3.4     Participation in surveys, price competitions

Insofar as you participate in surveys or price competitions offered via our website, we also use personal data from you in order to conduct these.

Personal data that we process in this context is UMAS registration data, and other information that you provide in this context.

The legal basis for the processing of this data is the performance of the contract with regard to all necessary information (Art. 6 para. 1 s.1 b) GDPR), for all other information the mutual interest (Art. 6 para. 1 s.1 f) GDPR).

If we (and possibly selected third parties) use your personal data for further purposes (e.g. display of personalised content or advertising based on your usage behaviour), the legal basis is your consent (Art. 6 para. 1 s.1 a) GDPR) via our Consent Management System. You can obtain further information and decision-making options here: https://b2bconnect.mercedes-benz.com/GB/help/cookies.

We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.

3.5     Other services integrated via the websites

In addition, we jointly use the personal data set out below with MBAG (and the dealers, if applicable) in order to provide you with certain services/dashboard views in connection with WebParts and the After Sales Applications and Data Content via our websites.

a. Parts search by entering the FIN / VIN

The "Parts search" application allows you to search for vehicle parts based on the FIN/VIN. In addition, you can add part numbers to the shopping basket without detours, import externally stored parts lists or select a template that you have stored, and have your Dealer's special offers displayed at the time of registration to B2B Connect.

In order to create vehicles and display specific parts in this application, the processing of your end customer's FIN/VIN and your UMAS registration data is required (if applicable, also your end customer's number plate for the "FIN/VIN number plate comparison" (for countries Great Britain, Netherlands, Sweden, France)). The transmission of FIN/VIN can be selected during the process.

The legal basis for the processing of this data is the performance of the contract with regard to all necessary information (Art. 6 para. 1 s.1 b) GDPR), for all other information the mutual interest to properly operating the services within B2B Connect and facilitate your collaboration with Dealers (Art. 6 pa-ra. 1 s.1 f) GDPR).

Data will be stored in the dashboards for as long as you make use of such a service or for as long as we need to store the data in order to comply with legal obligations (e.g. archiving obligations, which may take up to six or ten years).

We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.

b. Create vehicles

The "Create Vehicle" application enables you to manage a vehicle on the basis of its vehicle identification number (“FIN/VIN”) in order to simplify the use of the after sales services (including the search for vehicle spare parts and information on repair instructions, retrofitting options, fault diagnosis keys and other checklists as well as information on working hours, prices (incl. agreed conditions, if applicable) service packages and supplementary information in order to provide a precise cost estimate and efficient repair implementation, access to the Digital Service Booklet), for which further information is provided in the respective data protection policies.

In order to create and display specific vehicles in this application, the processing of your end customer's FIN/VIN and your UMAS registration data is required which can be selected during the process.

The legal basis for the processing of this data is the performance of the contract with regard to all necessary information (Art. 6 para. 1 s.1 b) GDPR), for all other information the mutual interest (Art. 6 para. 1 s.1 f) GDPR).

We collect the personal data set out in this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.

c. Order history / dealer / account

Furthermore, we enable you to view via our websites (i) which products have been purchased by you via WebParts and in the form of After Sales Applications and Data Content (including how long they will remain available), (ii) which dealers you have selected and (iii) which other users are registered for your organisation.

The use requires the processing of your UMAS registration data as well as the registration data of other users of your organisation and your order information.

The legal basis for the processing of this data is the performance of the contract (Art. 6 para. 1 s.1 b) GDPR).

We collect the personal data set out under this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.

d. Ticket Support

Pre-selected Dealers may support you with complaints or other requests concerning a transaction via B2B Connect. The pre-selected Dealer may receive access to your service requests (e.g. tickets) and may support you with those through the B2B Connect Seller Center in order to provide support. Dealers may also support you with opening accounts and related transactions via B2B Connect. Such a support is provided only in the relationship between you and the respective Dealer and occurs exclusively under the responsibility of the latter who is acting as a controller in the meaning of the GDPR.

The legal basis for allowing the dealer to access the relevant data is the legitimate interest to allow for a most efficient operation of the services and their use by you (Art. 6 para. 1 s.1 f) GDPR).

Data will be stored for as long as you make use of such a service or for as long as we need to store the data in order to comply with legal obligations (e.g. archiving obligations, which may take up to six or ten years).

e. Partners’ Customer Management

B2B Connect Seller Center enables Partners to create profiles for their Customers in order to manage the overall customer relationship.

In this context, Customer data (e.g. company name, user ID, employee name, company address, order, parts ect.) is processed.

The legal basis for the processing of this data is the performance of the contract with regard to all necessary information (Art. 6 para 1 s. 1 b) GDPR).

Data will be stored for as long as you make use of such a service or for as long as we need to store the data in order to comply with legal obligations (e.g. archiving obligations, which may take up to six or ten years).

f. Customer performance

Partners have the opportunity to view the performance of their Customers and run business reportings based on sales number etc, in the B2B Connect Seller Center. Analyses and reportings can be created that show you for example with which Customer Partner achieved the highest increase in turnover, the highest decline in turnover etc.. For this purpose, Customer data (e.g. company name, user ID, employee name, company address, order, parts ect.) is processed.

We typically process such data as a data processor in the meaning of Art. 28 GDPR on your behalf.

g. 5*Rater

In addition, an evaluation tool is made available to you for evaluating the performance of the dealers via WebParts as well as these websites. This is intended to improve the performance of the dealers and these websites.

When you use the 5*Rater, the order number and order status (if related to a product) as well as your UMAS registration data and feedback are processed. This data will also be passed on to the dealers so that they can contact you if necessary in order to implement your feedback accordingly.

The legal basis for the processing of this data is a direct implementation of your feedback as performance of contract comprehending the 5*Rater as a voluntary service (Art. 6 para. 1 s.1 b) GDPR), possibly also your consent (Art. 6 para. 1 s.1 a) GDPR) by means of our Consent Management System, if the data is used for purposes of internal analysis. You can obtain further information and decision-making options here: https://b2bconnect.mercedes-benz.com/GB/help/cookies.

We collect the personal data set out under this section directly from you by you having provided the personal data yourself. Without processing the personal data, it is not possible to provide the services set out in this section.

3.6     Business analyses and marketing campaigns

For market research and internal business analysis purposes, dealers and we provide MBAG with specific data relating to aftersales service transactions via WebParts, including invoice number, or parts/services that have not been sold (“lost sales”), FIN/VIN, dealer ID, information on products, parts or services sold, registration number (UK only), first registration and mileage of a vehicle.

When processing the data, it may be supplemented by other information known to MBAG about the transmitted vehicle, its model, series, equipment or its parts and components. As a rule, this processing is carried out to improve the quality of the data transmitted by the dealer (e.g. addition of the date of first registration if the dealer has not entered this). The transmitted data may also be used by MBAG in anonymised form for other processing purposes, such as statistical and analysis purposes.

a. Business analyses

Based on the data provided, MBAG performs customary aftersales and business analytics evaluations for further use by the respective dealers and us (e.g. to determine how many products of a certain type have been sold in a country or to validate pricing models). MBAG employees engaged in these tasks are not able to attribute the data provided to any natural person. The results produced as part of these tasks are limited to aggregated reports that do not contain any personal data. MBAG and its employees operate strictly in accordance with the needto- know principle and have implemented specific safeguards to ensure the processing of such data in accordance with its stated purposes.

MBAG and its employees operate strictly in accordance with the need-to-know principle and have implemented specific safeguards to ensure the processing of such data in accordance with its stated purposes.

The legal basis for this type of processing is the legitimate interests of us, the dealers and MBAG (Art. 6 para. 1 s.1 f) GDPR), which is to operate the most efficient sales systems possible. The lawfulness of the processing for the business analyses forms the legitimate interest of us, the dealers and MBAG (Art. 6 para. 1 s.1 f) GDPR), which consists in improving the effectiveness of sales and internal business processes.

b. Marketing campaigns

In some markets, MBAG may process the above data to assist dealers and us in conducting direct marketing campaigns. MBAG may also centrally manage and send relevant marketing campaigns and materials to end customers in the name of and on behalf of the aforementioned. In some markets we may provide similar services to dealers.

All these activities are carried out exclusively on behalf of the dealers and us (if applicable, data processing on behalf pursuant to Art. 28 GDPR).

We collect the personal data set out in this section directly from you by you having provided the personal data yourself or indirectly from your activities on our websites.

3.7     Newsletter

If you subscribe to a newsletter offered on our websites, the data provided when registering for the newsletter will be used solely for the purpose of mailing the newsletter, unless you consent to its use for additional purposes. You may unsubscribe at any time by using the unsubscribe option provided in the newsletter.

To register, you must provide us with your email address. You can voluntarily provide us with additional information, such as your name. The registration takes place in a so-called double opt-in procedure. After registration, you will receive a confirmation email from us in which you must confirm the registration again. This entire process is documented and stored. This includes the storage of the registration and confirmation time as well as your IP address.

The legal basis for the processing of personal data in connection with the sending of the newsletter is your consent (Art. 6 para. 1 s.1 a) GDPR).

You can revoke your consent to the processing of your personal data in connection with the sending of the newsletter at any time by cancelling the newsletter. For this purpose, please use the provided link at the end of the newsletter to cancel. The legality of the data processing already carried out remains unaffected by the revocation.

3.8     Use due to legal obligation

In addition, we use your personal data if we are legally obliged to do so (e.g. storage to comply with commercial or tax retention obligations, disclosure in accordance with official or court orders, e.g. to a law enforcement agency).

In this case, the legal basis for the processing of personal data is the fulfilment of legal requirements (Art. 6 para. 1 s.1 c) GDPR). Your personal data will be deleted immediately if it is no longer required for the fulfilment of legal obligations.

4. Transfer of personal data to third parties; social plug-ins; use of service providers

a. Our websites may also include third-party offers. When you click on such an offer, the required scope of data to the offering party (e.g. the information that you found this offer on our website and any other information which you have already provided for this purpose).

b. If we use so-called "social plug-ins" from social networks such as Facebook and Twitter on our websites, we integrate these as follows:

When you visit our websites, the social plug-ins are deactivated, i.e. no data is transferred to the operators of these networks. If you wish to use one of the networks, you can click on the relevant social plugin to establish a direct connection with the server of the respective network and you are logged in to this specific social network at the time you activate the social plug-in, this network can attribute your.

If you have a user account with the network and are logged in at the time the social plug-in is activated, the network can assign your visit to our website to your user account. If you would like to prevent this, please log out from the network a prior to activating the social plugin. A social network in unable to attribute a visit to other Mercedes-Benz websites before you have not also activated any available social plug-in there.

If you activate a social plug-in, the network directly transfers the consequently available data to your browser, which integrates it into our websites. In this situation, there may also be data transfers may also take place that are initiated and controlled by the respective social network. Your connection to a social network, the data transfers that are initiated and controlled by the corresponding social network, which takes place between the network and your system and your interactions on this platform are subject solely to the data protection provisions of the network concerned.

The social plug-in remains active until you deactivate it or delete your cookies (see section 5.d).

The legal basis for this type of processing on our websites is our legitimate interest (Art. 6 para. 1 s.1 f) GDPR), which is to enable you to use the social plug-ins, which you indicate by clicking on them.

c. When you click on the link to an offer or activate a social plug-in, personal data may be transferred to providers in countries outside the European Economic Area which, from the perspective of the European Union ("EU"), do not ensure an "adequate level of protection" for the processing of personal data in line with EU standards. Please bear this in mind before clicking on a link or activating a social plug-in and thereby triggering a transfer of your data.

d. We also use qualified service providers (e.g. IT service providers, marketing agencies) to operate, optimise and secure our websites. We only forward personal data to them insofar as this is necessary for the provision and use of the websites and their functionalities, for the pursuit of legitimate interests (both Art. 6 para. 1 s.1 f) GDPR), for the fulfilment of legal obligations (Art. 6 para. 1 s.1 c) GDPR) or insofar as you have consented to this (Art. 6 para. 1 s.1 a) GDPR). You can find more details on the recipients (in case of consent) in our Consent Management System: https://b2bconnect.mercedes-benz.com/GB/help/cookies.

5. Cookies

a. Cookies may be used when visiting our websites. Technically, these are so-called HTML cookies and similar software tools such as web/DOM storage or local shared objects (so-called "flash cookies"), which we refer to collectively as cookies.

b. Cookies are small files that are stored on your desktop, notebook or mobile device when you visit a website. From these, it is possible to recognise, for example, whether there has already been a connection between the device and the websites, to take into account your preferred language or other settings, to offer you certain functionalities (e.g. online shop, vehicle configurator) or to recognise your interests on a usage basis. Cookies may also contain personal data.

c. Whether and which cookies are used when you visit our websites depends on which areas and functions of our websites you use and whether you consent to the use of cookies that are not technically necessary in our Consent Management System. For more information and decision-making options, please click here: https://b2bconnect.mercedes-benz.com/GB/help/cookies

d. The use of cookies also depends on the settings of the web browser you use (e.g. Microsoft Edge, Google Chrome, Apple Safari, Mozilla Firefox). Most web browsers are preset to automatically accept certain types of cookies; however, you can usually change this setting. You can delete existing cookies at any time. You can delete web/DOM storage and Local Shared Objects separately. You can find out how this works in the browser or device you are using in the provider's instructions.

e. Consent to cookies as well as rejection or deletion of cookies are linked to the device used and also to the web browser used in each case. If you use several devices or web browsers, you can make the decisions or settings differently in each case.

f. If you decide against the use of cookies or delete them, it is possible that not all functions of our websites or individual functions will only be available to you to a limited extent.

6. Evaluating usage data; using analysis tools

a. We would like to match the content of our websites as accurately as possible to your interests and consequently improve our offer for you. We use the following analysis tools to identify user preferences and particularly popular areas of the websites: Google Analytics.

b. When using these analysis tools data may be transferred to servers in the USA where it is processed. Please note the following in this connection: in the view of the European Union, the standards which prevail in the USA do not correspond to an “adequate level of protection” in accordance with EU standards for the processing of personal data. This level of protection can be verified for individual companies by certification in accordance with the so-called “EU-U.S. Privacy Shield”.

c. If you do not want us to collect and analyze information relating to your visit to our website using the analysis tools, you can object to the future use of such tools for this purpose at any time ("opt-out").

We shall implement your opt-out by setting an opt-out cookie in your browser. This cookie serves exclusively to assign your opt-out. Please note that an opt-out cookie is only effective in the browser in which it was activated for technical reasons. If you delete cookies or use a different browser or terminal, you must again opt-out.

d. In the following section we have provided information about the providers of the analysis tools we use and the corresponding opt-out options:

i. Google Inc. (“Google“):
Google is certified in accordance with the EU-U.S. Privacy Shield.

You can prevent transfer, recording and processing of your data and its collection and processing by Google. Google informs about this via the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

7. Usage-based information (targeting and retargeting)

We use what are known as retargeting technologies in order to be able to match our online marketing (e.g. banner advertising) more specifically to your requirements and interests on the websites of our retargeting partners (Flashtalking, Google Adwords, Google Doubleclick and Vivaki). Your interest in our products and services is stored in cookies to this end. These cookies are processed and used when visiting other websites which cooperate with our retargeting partners, in order to be able to provide you with information related as closely as possible to your interest. This is done anonymously, i.e. you cannot be identified by retargeting.

If you do not wish Mercedes-Benz and its retargeting partners to collect, save and analyse information about your visit, or to match banner advertising to your interests, you can opt-out of this at any time for the future.

For the technical implementation of your objection it is necessary to save an opt-out cookie in your browser. This cookie serves exclusively to assign your rejection. Please note that for technical reasons, an opt-out cookie can only be used for the browser from which it was set. If you delete cookies or use another browser or different browser or terminal, you must once again opt out.

You can manage and deactivate the use of cookies by third party providers on the following website:

http://www.youronlinechoices.com/uk/your-ad-choices

8. No obligation to provide

The provision of personal data by the data subjects (you, end customers) is generally voluntary. In principle, there is neither a legal nor a contractual obligation on the part of the data subjects to provide the data. However, in the event of non-provision of personal data (such as the FIN/VIN), it may be that individual services or parts thereof cannot be provided or cannot be provided properly. In individual cases, the provision may even be required by law (e.g. in the case of mandatory recalls).

9. Security

We use technical and organisational security measures in order to protect your data we have under our control/managed by us against manipulation, loss, destruction and against access by unauthorised persons. We continuously improve our security measures in line with technological developments.

10. Deletion of your personal data

Your IP address and the name of your internet service provider, which we store for security reasons, are deleted after seven days as described above. Storage beyond this period is possible. In this case, the IP addresses are deleted or alienated so that it is no longer possible to assign the calling client.

Otherwise, we delete your personal data as soon as the purpose for which we collected and processed the data no longer applies. Beyond this time period, data storage only takes place to the extent made necessary by the legislation, regulations or other legal provisions to which we are subject in the EU or by legal provisions in third-party countries if these have an appropriate level of data protection. Should it not be possible to delete data in individual cases, the relevant personal data are flagged to restrict their further processing.

11. Data subjects' rights

a. As a data subject (person) affected by data processing, you have the right to information (Art. 15 GDPR), correction (Art. 16 GDPR), data deletion (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

b. If you have consented to the processing of your personal data by us, you have the right to revoke your consent at any time. The lawfulness of the processing of your personal data until revocation is not affected by the revocation. Likewise, further processing of this data on the basis of another legal basis, such as for the fulfilment of legal obligations, remains unaffected.

c. Right to object:
You have the right to object at any time, for reasons relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6 para 1 s.1 e) GDPR (data processing in the public interest) or Art. 6 para. 1 s.1 f) GDPR (data processing on the basis of a balance of interests). If you object, we will only continue to process your personal data if we can demonstrate compelling legitimate grounds for doing so that override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims. If we process your personal data for the purpose of direct marketing to protect legitimate interests on the basis of a balance of interests, you also have the right to object to this at any time without giving reasons.

d. We ask you to send your claims or explanations to the following contact address if possible: dialog@mercedes-benz.com

e. If you believe that the processing of your personal data violates legal requirements, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR).

12. Automated decisions

We will not use your personal data to make automated decisions (including profiling) about you that have legal effect on you or similarly significantly affect you.

13. Mercedes-Benz AG Central Access Service

With the Central Registration Service offered by Mercedes-Benz AG, you can sign up for every website and application belonging to the Mercedes-Benz Group and its brands that are connected to the service. The applicable terms of use contain specific data protection provisions. Those terms of use can be found on the registration pages of affiliated websites and applications.

14. Data transfer to recipients (outside the European Economic Area)

14.1. Recipients in general

We share your personal data with the following recipients:

a. We use processors to process personal data for the above purposes, who process the personal data on our behalf. We retain control over the respective personal data and remain the data controller.

b. For payment processing in the course of orders, we transmit payment details to banks or payment service providers if required by the payment method.

c. In individual cases, we may, at your request, share the personal data required for the order with our international representative offices (other companies in the group of companies). Unless there is an adequacy decision of the European Commission for the respective third country outside the European Economic Area, this is done for the performance of a contract (on the basis of Art. 49 para. 1 b) GDPR).

d. We transmit personal data in individual cases to courts, law enforcement agencies, supervisory authorities, other authorities, tax advisors and lawyers if this is legally permissible and necessary.

14.2 Recipients outside the European Economic Area

a. When using service providers (see section 4. d.) and passing on data with your consent (= approval) to third parties (see for example section 5), personal data may be transferred to recipients in countries outside the European Union ("EU"), Iceland, Liechtenstein, Norway and United Kingdom ( European Economic Area) and processed there, in particular USA, India.

b. In the following countries, there is an adequate level of protection for the processing of personal data from the EU's perspective (so-called adequacy decision): Andorra, Argentina, Canada (limited), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay. With recipients in other countries, we agree to apply EU standard contractual clauses, binding corporate rules to provide an "adequate level of protection" in accordance with legal requirements. We will be happy to provide you with information on this via the contact details mentioned in point 9.d. above.

Status: February 2024