The purpose of this privacy notice (“Notice”) is to inform you of how Kawasaki Motors, Ltd. (“we” or its derivative forms), the operator of “RIDEOLOGY THE APP KX2” (“App”), will process your personal data as a data controller in connection with the App related services (“App Services”), and to inform you (“you” or its derivative forms) about the measures and processes we have put in place to ensure the adequate protection of your personal data.

This Notice does not form any contractual relationship between you and us, and we may amend it from time to time.

The Sections from 1 to 10 are relevant to all users. The Sections from 11 to 17 are relevant to users residing in certain jurisdictions.

1. Section 11: European Economic Area and United Kingdom residents
2. Section 12: United States residents
3. Section 13: United Kingdom residents
4. Section 14: French residents
5. Section 15: Spanish residents
6. Section 16: Vietnamese residents
7. Section 17: Brazilian residents

If you are a resident of California, please see Section 12 for additional information.

When you use the App, we collect data that may be linked to you. Depending on how you use the App, this may include identifiers, internet or other electronic network activity information, and geolocation data. Additional data may be collected if you enable other App features. Much of this information is collected in the background through tools such as SDKs while you use the App, although some information, such as your account login details, is provided directly by you.

When you use the App, you have choices about how your data is collected and used. You can enable or disable push notifications and location collection in your device settings. You can also delete the App from your device to stop data collection. You can delete the information already collected via the account deletion option available in the App. For information on how to access or manage the use of your mobile device ID for advertising purposes, please review the Network Advertising Initiative's Advertising Privacy Settings on Mobile Devices page.

Because of the international nature of our business, we may need to transfer your personal data within our group companies, and to other parties as noted in Section 5 below, in connection with the purposes set out in this Notice. The storage as well as the processing of your personal data as described above may require that your personal data is ultimately transferred/transmitted to, and/or stored at, a destination outside of your country of residence.

We may transfer your personal data to a third country. In such case, we will take appropriate measures such as obligating the third party to conduct appropriate security management through a data protection agreement.

We may transfer your personal data to the USA. Although there is no comprehensive law or regulation in the USA as a system for the protection of personal data, there are systems for privacy protection established by the Federal Trade Commission or other organizations. The USA is one of the participating economies of the Global Cross-Border Privacy Rules (CBPR) system, under which it is considered that substantially the same level of protection as in Japan can be expected for the protection of your personal data.

For further details of such systems or the like for the protection of personal data in the USA, please see the investigation results of the PPC (in Japanese only).

The receiving party will process personal data in compliance with the OECD Privacy Principles.

7.1 If you wish to request any of the items below, we will first verify that the request is actually being made by or on behalf of you, and upon verification, we will respond to the request in accordance with applicable laws:

1. notification of the purpose of use of the personal data;
2. disclosure to the principal of the relevant personal data that enable identification of you;
3. correction or deletion of, or addition to, the relevant personal data that enable identification of you; or
4. discontinuation of use, erasure or discontinuation of the provision to third parties of the relevant personal data.

You can make a request regarding the above by contacting us as set out in Section 10 below.

7.2 In any of the situations listed above, we may request that you prove your identity by providing us with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorized disclosure of data.

If European Economic Area or United Kingdom residents use the App, the following additional data protection information applies:

In reference to

11.1 Section 3: In connection with the use of the App Services we request personal data from you, such as your name, nickname or location and, if necessary, further personal information. Without this information, we may not be able to provide you with the requested App Services or answer any inquiries you may have. In the following, we provide you with an overview of the related processing operations and legal bases in connection with your respective personal data:

1. Using the App

   Registration process

   In order to use the App Services you can register via single sign-on login by using your already existing Google or Apple account information. We use the single sign-on login to authenticate potential users via the service as natural persons and to be able to determine the identity of the users. In the context of authentication, only data is transmitted that ensures that the user is actually (i) someone who uses the App and (ii) a natural person and not, for example, a "bot." The third-party services have no access to any information about your user behavior or profile data. You sign on using the Google or Apple log-in. Google or Apple will authenticate you by sending a token to us, identifying you as the user. During this authentication process, Google or Apple may store cookies or other similar technology in your browser or the app's embedded browser. For more details, please visit Google's or Apple's website. The legal basis for this data processing is Article 6 (1) p. 1 lit. b) of the General Data Protection Regulation ("GDPR"), because the authentication function is required for the fulfillment of the contract concluded or to be concluded between us. The provision of personal data for this purpose is mandatory in order to complete the registration process and ultimately, to access the App Services. If you do not wish your data to be shared, please refrain from using the App.

   Provision of App Services

   We process your personal data (e.g., Account ID, Account Name, and location) to enable the performance of the App Services, including the recording and provision of riding logs.

   The legal basis for this data processing is Article 6 (1) p. 1 lit. b) GDPR, because it is necessary to fulfill the user contract with you. The provision of personal data for this purpose is mandatory in order to complete the registration process and ultimately, to access the App Services. If you do not wish your data to be shared, please refrain from using the App.

   Location Tracking

   With Google Maps, we can show you your location or the location of your vehicle and, thus, adapt our service to your needs and provide you a better user experience. We only connect the App with Google Maps. We do not share any user profile data with Google. The legal basis for this processing of your data is based on your consent according to Article 6 (1) p. 1 lit. a) GDPR.

   User Support

   If you contact us by using the contact form, your personal data will be stored and processed by us. Such personal data is usually your Account ID and your country, as well as the information you have otherwise provided. Such personal data is stored and used for the purpose of responding to your requests or for contacting you or the associated technical administration. Your personal data is not passed on to third parties without your consent. The legal basis for this data processing is Article 6 (1) p. 1 lit. b) GDPR insofar as it is used to carry out your request and to reply to you to answer your inquiries – in this case the provision of personal data for this purpose is mandatory in order to access the User Support center as well as Article 6 (1) p. 1 lit. f) GDPR, as the processing of these requests is in the interest of both you and us. If you do not wish your data to be shared, please refrain from using this functionality.

2. Business-related context

   Performance

   We process your personal data to improve and to maintain the App Services or to fix bugs. The legal basis for this data processing is Article 6 (1) p. 1 lit. f) GDPR, insofar as these processing activities are in our and your legitimate interest to ensure the stability and security of the App.

   Advertising

   We process your personal data to promote motorsports activities and for commercial purposes, such as the presentation of our goods and services. We only use data in an anonymized or aggregated format. You will not be able to be identified within this group. We do not use your profile information in order to provide personalized ads customized to your individual use of the App. Therefore, the promotion of our products and services is based on our legitimate interest under Article 6 (1) p. 1 lit. f) GDPR.

   Research and Development

   We process your personal data to ensure the overall quality of the App and to develop new products and services. We only use data in an anonymized or aggregated format, i.e., to gather groups of users of a certain age or region to analyze differences in their riding history and vehicle usage, and their use of the App, as well as their experiences and issues. This information helps us to maintain the stability of the App, update certain features or develop new/better products, including vehicles and services. We will not be able to identify you within this group. We do not use your profile information in order to individually track your use of the App. The legal basis for this data processing is our legitimate interest under Article 6 (1) p. 1 lit. f) GDPR in facilitating the research and development of our services and in constantly making our vehicles and vehicle-related services safer and better for you.

11.2 Section 4: Depending on the way your personal data is processed, it may also be transferred outside the EU/EEA or United Kingdom. In these cases, we ensure that an adequate level of data protection exists before transferring your personal data to a country without an adequacy decision. This means that we will apply the necessary measures, including EU and/or United Kingdom standard contractual clauses and other measures needed under Chapter 5 of the GDPR, to ensure a level of data protection that is comparable to the standards within the EU or United Kingdom.

11.3 Section 5: We may disclose your personal data to the following categories of recipients:

1. Service providers acting as our data processors, strictly under our instructions, or as data controllers, particularly for cloud hosting, technical maintenance, analytics, map functionality, authentication or support services.
2. Our group companies within and outside the EEA/UK, but only for purposes directly connected with the functionality, support, development, or maintenance of the App, and based on necessary data protection safeguards.
3. Public authorities, courts, or regulators, if legally required to do so.
4. Prospective buyers in case of restructuring, merger or business sale, based on legitimate interests and subject to strict confidentiality and data protection obligations.

These recipients access personal data only to the extent required for their respective tasks or services and exclusively for specific purposes. Except where otherwise required by law, we do not disclose personal data to unrelated third parties for their own purposes. Further information on the recipients is available upon request.

11.4 Section 7: You have the following data protection rights, depending on the circumstances of the specific case:

• Right to information and access to personal data concerning yourself. This means that you have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and the purposes of such processing;
• Right to rectification or erasure or to restriction of the processing of your personal data. If we are processing inaccurate personal data, you have the right to obtain rectification of such inaccurate personal data. You have the right to request the erasure of your personal data, subject to certain conditions;
• Right to object to data processing. You have the right to object, on grounds relating to your specific situation, to the processing of your personal data which is based on Art. 6(1)(e) (tasks in the public interest) or 6(1)(f) GDPR (our specified legitimate interests). You also have the right to object to the processing of personal data where personal data is processed for direct marketing purposes, unless you want to object to the processing in part;
• Right to withdraw consent. As far as our processing is based on a consent (pursuant to Art. 6(1)(a) GDPR), you may withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on the consent before its withdrawal;
• Right to restriction of processing. You have the right to request restriction of processing your personal data;
• Right to data portability. You have the right to request a copy of your personal data in order to transmit such data to another controller;
• Right to lodge a complaint with the competent supervisory authority. You have the right to lodge a complaint with a data protection supervisory authority located in the European Union or the UK.

In addition, you have the right to object to the processing of your personal data at any time:

• if we process your personal data for direct marketing purposes; or
• insofar as we process your personal data for the pursuit of our legitimate interests and there are grounds based on your particular situation.

You may (i) exercise the above rights or (ii) ask questions or (iii) lodge a complaint against the processing of your personal data carried out by us by contacting us as indicated in Section 10 above.

This Section 12 supplements the other parts of our Notice and provides additional information for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia (collectively, "Covered States").

As used in this Section 12, the term "personal data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. "Personal data" includes "personal information" as defined by the California Consumer Privacy Act ("CCPA").

Categories of Collected Personal Data

We plan to collect the following categories of personal data in Table 1:

Table 1

The following table explains the purposes for which we process your personal data and categories of processed information:

Table 2

Sales, Sharing, and Targeted Advertising

We do not engage in targeted advertising, and within the past twelve (12) months, we have not "sold" or "shared" personal data to third parties.

Your Covered State Privacy Rights

If you are a resident of a Covered State, you may have the following rights regarding your personal data (subject to certain exemptions). We will not discriminate against you for exercising your privacy rights.

Access and Disclosure

You have the right to request access to the categories of personal data we collected about you, the categories of sources from which we collected your personal data, our business or commercial purposes for collecting, or disclosing your personal data, the categories of recipients to which we have disclosed your personal data, and the specific pieces of personal data we have collected about you. You also have the right to request a portable copy of your personal data.

Correction and Deletion

You have the right to send us a request to correct or delete Personal Information we have about you, subject to certain exceptions allowed under applicable law.

Opt Out of Sales, Sharing, and Targeted Advertising

We do not engage in sales, sharing, or targeted advertising, and as such we do not offer this right.

Sensitive Personal Data

We do not use or disclose sensitive personal data for purposes to which the right to limit applies. As such, we do not offer this right.

Appeals

You may have a right to appeal decisions concerning your ability to exercise your privacy rights. Please email us at the address provided below to appeal a decision concerning your privacy request.

Authorized Agents

Applicable law may permit you to designate an authorized agent to submit privacy requests on your behalf. If you would like to designate an authorized agent to submit a request to access, delete, or correct on your behalf, your authorized agent may contact us as provided below. Consistent with applicable law, we may still need to verify your identity, and the authority of the authorized agent to submit requests on your behalf.

Making Privacy Requests

To make a CCPA request, you or an authorized agent may call us at (855) 976-2844, email us at the address set out in Section 10 above, or write us at Kawasaki Motors, Ltd. 1-1, Kawasaki-cho, Akashi, Hyogo, 673-8666, Japan (Attn: Privacy Request). We may verify your identity by matching personal data you provide with data we process in our systems.

U.S. Minors

The App is intended for a general audience and not directed to children less than thirteen (13) years of age.

California-Specific Disclosures

Shine the Light

California's "Shine the Light" law permits California residents to request certain information regarding our disclosure of personal data to third parties for their own direct marketing purposes. However, we do not disclose personal data to third parties for their own direct marketing purposes. If you are a California resident, you may request information about our compliance with Shine the Light by contacting us at the address set out in Section 10 above. Requests must include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each calendar year.

Nevada-Specific Disclosures

Nevada law allows customers to "opt out" of the sale of certain personal information, called "covered information." We do not sell covered information as defined in the law, and we have no plans to change that practice. If you want to be notified if we do change that practice, you may email us at the address set out in Section 10 above and provide your name, Nevada mailing address, and email address. We will contact you if there are any changes, and you can complete your opt out at that time. If your contact information changes at any point, contact us in the same manner to update your contact information. We may share your data as explained in this Notice for different purposes, such as to make your experience and our App Services better, and those activities are separate from your opt-out request.

If United Kingdom residents use the App, the following applies in addition to the information for European Economic Area and United Kingdom residents under Section 11 above:

Children

The App is intended for a general audience and not directed to children less than eighteen (18) years of age.

Complaints

If you have concerns about how we handle your personal data, you have the right to complain to us by contacting us at the address set out in Section 10 above. We will acknowledge your complaint within 30 days of receipt, investigate and respond to you without undue delay and keep you informed of progress. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator (see here for more details: https://ico.org.uk/make-a-complaint/data-protection-complaints/). You can complain to the Information Commissioner's Office at any time, whether or not you have complained to us first.

If Spanish residents use the App, the following additional data protection information apply:

In reference to

15.1 Section 7: Insofar as we process your personal data for the pursuit of our legitimate interests and there are grounds based on your particular situation. Users have the right to request information about the balancing test carried out by us in order to assess the validity of such legal basis. Moreover, users have at any time the right to exercise their right to object with respect to the processing activities based on the legitimate interest of the data controller. If you considered that your data protection right request hasn't been fully attended to, you can also file a report to the Agencia Española de Protección de Datos. More information: www.aepd.es

15.2 Section 8: At the end of the retention period, we would store your data, duly blocked, during the prescription periods of the legal obligations we are subject to and the potential liabilities that might arise from the processing of your personal data. Afterwards, we will take steps to delete your personal data or hold it in a form that no longer identifies you.

15.3 The App is intended only for users over sixteen (16) years old. When you download and use the App you declare that you meet this minimum age requirement.

If you are a resident of Vietnam, the following regulations apply.

16.1 Regarding Section 2:

The personal information we collect is as follows:

1. Basic personal information data:
   • Birth year and month
   • Gender
   • Other information as mentioned in Section 2 except for the information in (b) below.
2. Highly confidential personal information data:
   • Location information (Note: This is highly confidential personal information.)

16.2 Regarding Section 5: In addition to Section 5, the following cases also apply:

1. In an emergency, it is necessary to immediately process relevant personal data to protect the life and health of the data subject or other people.
2. Disclose personal data in accordance with the law.
3. Processing data of competent state agencies in case of emergency situations related to national defense, national security, social order and safety, major disasters, dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; prevent and combat riots, terrorism, prevent and combat crimes and violations of the law according to the provisions of law.
4. Fulfill the data subject's contractual obligations with relevant agencies, organizations and individuals according to the provisions of law.
5. Serving the activities of state agencies regulated by specialized laws, etc.

16.3 Regarding Section 7: In addition to the content in Section 7, the following cases are also included.

1. The right to consent or not consent to the processing of your personal data, unless otherwise provided by law.
2. You have the right to withdraw your consent, unless otherwise provided by law.
3. To delete or request deletion of your personal data, unless otherwise provided by law.
4. Be required to limit the processing of your personal data to seventy-two (72) hours after the data subject's request, unless otherwise provided by law.
5. To request the Data Controller to provide you with your personal data, unless otherwise provided by law.
6. To object to the Data Controller processing your personal data within seventy-two (72) hours after receiving the request in order to prevent or limit the disclosure of personal data or use for advertising or marketing purposes, except in cases where the law provides otherwise.
7. Have the right to complain, denounce or sue according to the provisions of law.
8. Have the right to request compensation for damages according to the provisions of law when there is a violation of regulations on protecting your personal data, unless the parties have otherwise agreed or the law has other provisions.
9. Have the right to self-protect according to the provisions of civil law, other relevant laws or request competent agencies or organizations to do so.

16.4 Regarding Section 8: Data processing start and end times are as follows:

Data processing begins: After "agree" to the privacy policy (privacy notice)

Termination of data processing: upon user request or when our service ends.

16.5 For each of the above items, the following further applies:

User obligations:

• Protect your personal data; Request other relevant organizations and individuals to protect their personal data.
• Respect and protect the personal data of others.
• Provide complete and accurate personal data when agreeing to process personal data.
• Participate in propagating and disseminating personal data protection skills.
• Implement legal regulations on personal data protection and participate in preventing and combating violations of personal data protection regulations.

Consequences may occur due to unexpected damage during data processing:

• Data leakage due to cyber attacks, hackers, viruses, etc.
• Data is stolen to commit illegal acts.
• Competent state agencies request data to serve investigation activities, state management work, etc. according to the provisions of law.

For minors in Vietnam

This application is intended for general use and is not intended for children under 18 years of age.

When the user is located in the territory of the Federative Republic of Brazil, the processing of their personal data carried out in connection with RIDEOLOGY THE APP KX2 shall be subject to Law No. 13,709/2018 – the Brazilian General Data Protection Law ("Lei Geral de Proteção de Dados Pessoais" – "LGPD"), pursuant to Article 3 thereof.

In such case:

1. the processing of personal data shall comply with the principles, rights, and safeguards established under the LGPD;
2. the data subject rights provided for under Article 18 of the LGPD, including, but not limited to, the following:
   1. confirmation of the existence of personal data processing;
   2. access to personal data;
   3. correction of incomplete, inaccurate, or outdated personal data;
   4. anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed personal data;
   5. data portability, where applicable and subject to applicable trade secrets and industrial secrets;
   6. deletion of personal data processed based on consent, where applicable;
   7. information regarding public and private entities with which personal data has been shared;
   8. revocation of consent, where consent is the legal basis for the processing;
   9. objection to processing carried out based on legal grounds other than consent, where applicable;
   10. review of decisions made solely on the basis of automated processing that affect the data subject's interests;

   may be exercised through the contact channels indicated in this Privacy Policy;

3. the application of foreign laws or references to other data protection regimes shall not exclude or limit the applicability of the LGPD;
4. in the event of any conflict between this Privacy Notice and provisions applicable to other jurisdictions, the provisions consistent with the LGPD shall prevail with respect to users located in Brazil.

Personal data shall be processed solely for the purposes disclosed to the data subject at the time of collection or, subsequently, for purposes compatible with those originally disclosed, in accordance with the LGPD.

This section shall be interpreted in conjunction with the other provisions of this Privacy Policy and shall apply on a complementary and prevailing basis to users located in Brazil.