Privacy Policy

Data Controller: Exotic Auto Services
Location: Musaffah - M21 - Abu Dhabi - United Arab Emirates
Website: bmw-garage.ae
Email: campaign@exoticautoservices.ae

Exotic Auto Services is the data controller responsible for all personal data collected through bmw-garage.ae and through direct service interactions, in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Exotic Auto Services collects 3 categories of personal data: identification and contact data, vehicle data, and website usage data. Data is collected only when individuals voluntarily provide it through booking channels or when it is generated automatically through website interaction.

Identification and Contact Data

Collected when an individual submits the online booking form, contacts the workshop by phone, or sends a message via WhatsApp or email.

Vehicle Data

Collected to identify the correct BMW model and chassis platform, confirm OEM-grade parts specifications from BMW-approved suppliers, and record completed BMW repair and maintenance history.

Website Usage Data

Collected automatically when visitors access bmw-garage.ae. This data is anonymised and does not identify individual visitors by name or contact details.

Website usage data is collected through Google Analytics 4 (GA4) and website session cookies. Full details of cookies used on bmw-garage.ae are set out in the Cookie Policy.

Exotic Auto Services collects personal data for 5 lawful purposes, each grounded in a specific legal basis under the UAE Personal Data Protection Law.

1. Contractual Necessity: identification, contact, and vehicle data are processed to confirm BMW service bookings, assign the correct technician, prepare ISTA+ diagnostic profiles, issue written repair estimates, complete repairs using OEM-grade parts, and deliver the written service report at vehicle collection.
2. Legitimate Interest: phone numbers and WhatsApp details are used to provide real-time BMW repair status updates, notify customers when vehicles are ready for collection, confirm bookings, and communicate additional faults identified during diagnostics.
3. Legal Obligation: completed repair records, including VIN, chassis platform, OEM-grade parts replaced with part numbers, ISTA+ fault codes cleared, and technician notes, are retained to support 12-month warranty claims, future diagnostic accuracy, and compliance with UAE commercial record-keeping requirements.
4. Legitimate Interest: anonymised website usage data is processed to identify underperforming BMW service pages, improve booking form usability, and optimise the bmw-garage.ae experience.
5. Marketing Communications: BMW service reminders, CBS maintenance interval notifications, and promotional communications are sent only to customers who have explicitly opted in at the time of booking, and stopped immediately upon request.

Exotic Auto Services retains personal data for the minimum period necessary to fulfil each processing purpose.

Personal data is securely deleted or anonymised at the end of the applicable retention period. BMW owners request early deletion of their personal data at any time, subject to the legal obligation exceptions described above.

Exotic Auto Services shares personal data with 3 categories of third parties, each operating under contractual data processing agreements or applicable UAE privacy regulations.

• OEM Parts Suppliers — vehicle VIN, engine code, and chassis platform data are shared with certified BMW OEM parts suppliers solely to confirm parts availability and specification for the booked repair. Suppliers do not receive customer contact data.
• Analytics and Marketing Platforms — anonymised website usage data is processed by Google Analytics 4; marketing attribution data is processed by Google Ads and Meta where the visitor has accepted marketing cookies.
• Legal and Regulatory Authorities — personal data is disclosed to UAE government authorities, courts, or regulatory bodies when legally required under UAE law.

Exotic Auto Services does not sell, rent, or transfer personal data to any third party for commercial purposes.

Exotic Auto Services applies 4 categories of technical and organisational security measures to protect personal data from unauthorised access, loss, or disclosure.

1. Access Controls: customer data and vehicle service records are accessible only to authorised staff directly involved in delivering the booked service.
2. Secure Data Transmission: bmw-garage.ae uses HTTPS encryption (TLS) for all data transmitted through the booking form, contact pages, and website sessions. WhatsApp’s end-to-end encryption protects data transmitted via WhatsApp.
3. Data Minimisation: only the personal data necessary for each specific processing purpose is collected.
4. Staff Data Protection Training: all staff handling customer data complete data protection awareness training covering UAE PDPL obligations and breach response protocols.

No data transmission over the internet is entirely risk-free. Exotic Auto Services applies industry-standard security measures to minimise risk, but cannot guarantee absolute security of data transmitted to bmw-garage.ae.

Individuals whose personal data is held by Exotic Auto Services hold 6 rights under the UAE Personal Data Protection Law.

1. Right of Access — request a copy of all personal data held, the purposes it is processed for, who it is shared with, and applicable retention periods.
2. Right to Rectification — request correction of inaccurate or incomplete personal data.
3. Right to Erasure — request deletion of personal data no longer necessary for its original purpose, subject to legal retention obligations.
4. Right to Restrict Processing — request that processing be restricted while an accuracy dispute or objection is assessed.
5. Right to Object — object to processing for marketing communications at any time; these stop immediately upon a valid written objection.
6. Right to Withdraw Consent — withdraw consent for marketing communications or non-essential cookies at any time without affecting the lawfulness of prior processing.

Data rights requests are submitted to campaign@exoticautoservices.ae. Exotic Auto Services responds to all valid requests within 30 calendar days of receipt.

bmw-garage.ae is not directed at individuals under the age of 18. Exotic Auto Services does not knowingly collect personal data from individuals under 18. A parent or guardian who identifies that a minor has submitted personal data through bmw-garage.ae contacts Exotic Auto Services at campaign@exoticautoservices.ae to request immediate deletion of that data.

Exotic Auto Services is an independent BMW specialist workshop with no corporate affiliation, data sharing arrangement, or authorised dealership relationship with BMW AG, BMW Group, or any BMW Group subsidiary. Personal data and vehicle service records collected are not shared with BMW AG or any BMW Group entity. BMW vehicle trademarks and model designations referenced on bmw-garage.ae identify the vehicle types serviced and do not imply any data relationship with BMW AG.

Exotic Auto Services reviews and updates this privacy policy when data collection practices change, new third-party processors are engaged, or UAE privacy regulations are amended. The effective date at the bottom of this page reflects the most recent revision. Material changes to data processing practices are communicated directly to existing customers via email at least 14 days before the revised policy takes effect.

Data privacy questions, access requests, correction requests, erasure requests, and marketing opt-out requests are directed to the Exotic Auto Services team.

Website: bmw-garage.ae
Email: campaign@exoticautoservices.ae
Location: Musaffah - M21 - Abu Dhabi - United Arab Emirates

All data rights requests receive a written response within 30 calendar days.