The purpose of this privacy notice ("Notice") is to inform you of how Kawasaki Motors, Ltd. (“we” or its derivative forms), the operator of “RIDEOLOGY THE APP POWERSPORTS” (“App”), will process your personal data as a data controller in connection with the App related services (“App Services”), and to inform you (“you” or its derivative forms) about the measures and processes we have put in place to ensure the adequate protection of your personal data.

This Notice does not form any contractual relationship between you and us, and we may amend it from time to time.

The Sections from 1 to 10 are relevant to all users. The Sections from 11 to 18 are relevant to users residing in certain jurisdictions.

Because of the international nature of our business, we may need to transfer your personal data within our group companies, and to third parties as noted in Section 5 below, in connection with the purposes set out in this Notice. The storage as well as the processing of your personal data as described above may require that your personal data are ultimately transferred/transmitted to, and/or stored at, a destination outside of your country of residence.

We may transfer your personal data to a third country. In such case, we will take appropriate measures such as obligating the third party to conduct appropriate security management through a data protection agreement.

7.1 If you wish to request any of the items below, we will first verify that the request is actually being made by or on behalf of you, and upon verification, we will respond to the request in accordance with applicable laws:

1. notification of the purpose of use of the personal data;
2. disclosure to the principal of the relevant personal data that enable identification of you;
3. correction or deletion of, or addition to, the relevant personal data that enable identification of you; or
4. discontinuation of use, erasure or discontinuation of the provision to third parties of the relevant personal data.

You can make a request regarding the above by contacting us as set out in Section 10 below.

7.2 In any of the situations listed above, we may request that you prove your identity by providing us with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorized disclosure of data.

If European Economic Area or United Kingdom residents use the App, the following additional data protection information applies:

In reference to

11.1 Section 3: In connection with the use of the App Services we request personal data from you, such as your name or location and, if necessary, further personal information. Without this information, we may not be able to provide you with the requested App Services or answer any inquiries you may have. In the following, we provide you with an overview of the related processing operations and legal bases therefor in connection with your respective personal data:

1. Using the App

   Registration process

   In order to use the App Services you can register via single sign-on login by using your already existing Google or Apple account information. We use the single sign-on login to authenticate potential users via the service as natural persons and to be able to determine the identity of the users. In the context of authentication, only data is transmitted that ensures that the user is actually (i) someone who uses the App and (ii) a natural person and not, for example, a "bot." The third-party services have no access to any information about your user behavior or profile data. You sign on using the Google or Apple log-in. Google or Apple will authenticate you by sending a token to us, identifying you as the user. During this authentication process, Google or Apple may store cookies or other similar technology in your browser or the app's embedded browser. For more details, please visit Google's or Apple's website. The legal basis for this data processing is Article 6 (1) p. 1 lit. b) of the General Data Protection Regulation (“GDPR”), because the authentication function is required for the fulfillment of the contract concluded or to be concluded between us.

   Provision of Services

   We process your data (e.g. Nickname, Location) to enable the performance of the App Services, including the:

   • recording and provision of trip logs, and
   • provision of information on the location where you last connected to your vehicle

   The legal basis for this data processing is Article 6 (1) p. 1 lit. b) GDPR, because it is necessary to fulfill the user contract with you.

   Location Tracking

   We use the map service Google Maps via an API. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Particularly, we use Google Maps to enable the displaying of your riding log and tracked location. With Google Maps, we can show you your location or the location of your vehicle and, thus, adapt our service to your needs and provide you a better user experience. We only connect the App with Google Maps. We do not share any user profile data with Google. We have no influence on this data transmission. More information on the handling of user data can be found in Google's privacy policy:

   https://policies.google.com/privacy?hl=en

   The legal basis for this processing of your data is our legitimate interest according to Article 6 (1) p. 1 lit. f) GDPR in order to provide our App Services to you and to make the use of the App a very special experience for you.

   Connecting with other Users (“Share-Function”)

   To allow you to connect with other users and to share with them your trip log as well as your location, we may use the information you provide to use the App Services as well as GPS data. This data processing is based on our legitimate interest according to Article 6 (1) p. 1 lit. f) GDPR to fulfill your wish to connect with other users and to provide you with a better user experience.

   User Support

   If you contact us by using the contact form, your personal data will be stored and processed by us. Such personal data is usually your nickname and your country, as well as the information you have otherwise provided. Such personal data is stored and used for the purpose of responding to your requests or for contacting you or the associated technical administration. Your personal data is not passed on to third parties without your consent. The legal basis for this data processing is Article 6 (1) p. 1 lit. b) GDPR, insofar as it is used to carry out your request and to reply to you to answer your inquiries, as well as Article 6 (1) p. 1 lit. f) GDPR, as the processing of these requests is in the interest of both you and us.

2. Business-related context

   Performance

   We process your personal data to improve and to maintain the App Services or to fix bugs. The legal basis for this data processing is Article 6 (1) p. 1 lit. f) GDPR, insofar as these processing activities are in our and your legitimate interest to ensure the stability and security of the App.

   Advertising

   We process your data to promote motorsports activities and for commercial purposes, such as the presentation of our goods and services. We only use data in an anonymized or aggregated format. You will not be able to be identified within this group. We do not use your profile information in order to provide personalized ads customized to your individual use of the App. Therefore, the promotion of our products and services is based on our legitimate interest under Article 6 (1) p. 1 lit. f) GDPR.

   Research and Development

   We process your personal data to ensure the overall quality of the App and to develop new products and services. We only use data in an anonymized or aggregated format, i.e. to gather groups of users of a certain age or region to analyze differences in their riding history and vehicle usage, and their use of the App, as well as their experiences and issues. This information helps us to maintain the stability of the App, update certain features or develop new/better products, including vehicles and services. We will not be able to identify you within this group. We do not use your profile information in order to individually track your use of the App. The legal basis for this data processing is our legitimate interest under Article 6 (1) p. 1 lit. f) GDPR in facilitating the research and development of our services and in constantly making our vehicles and vehicle-related services safer and better for you.

11.2 Section 4: Depending on the way your personal data is processed, it may also be transferred outside the EU/EEA or United Kingdom. In these cases, we ensure that an adequate level of data protection exists before transferring your personal data. This means that via EU or United Kingdom standard contractual clauses or an adequacy decision, a level of data protection is achieved that is comparable to the standards within the EU or United Kingdom.

11.3 Section 7: You have the following data protection rights, depending on the circumstances of the specific case:

• Right to information and access to personal data concerning yourself
• Right to rectification or erasure or to restriction of the processing of your personal data
• Right to object to data processing and to withdraw consent
• Right to data portability
• Right to lodge a complaint with the competent supervisory authority

In addition, you have the right to object to the processing of your personal data at any time:

• if we process your personal data for direct marketing purposes; or
• insofar as we process your personal data for the pursuit of our legitimate interests and there are grounds based on your particular situation.

You may (i) exercise the above rights or (ii) ask questions or (iii) lodge a complaint against the processing of your personal data carried out by us by contacting us as indicated in Section 10 above.

This Section 12 (the “California Notice”) covers our collection, use, disclosure, and sale of California consumers' “Personal Information” (“PI”) as defined by the California Consumer Privacy Act (together with related amendments and regulations, the “CCPA”). This California Notice also explains the rights California consumers have under the CCPA, as well as other notices to Californians required by other laws. The description of our data practices in Section 2 and Section 3 of this Notice covers the prior calendar year and will be updated annually. Our current practices may change and will be updated in this Notice. If our practices materially change, we will provide appropriate pre-collection notices, which may include reference to this Notice or other applicable privacy policies and notices.

Categories of Collected Personal Information

We collected the following categories PI in the preceding 12 months.

• Identifiers such as an nickname, postal address (State level), online identifier, email address.
• Characteristics of protected classifications under California or federal law such as gender, birth year.
• Commercial information, including vehicle profile, maintenance history or information from In-App Contact Form or from you.
• Internet or other electronic network activity information, including, but not limited to, device model, operation system version number and the App version number.
• Geolocation data.
• Sensitive personal information such as your Google account and AppleID and password, and precise geolocation.

Categories of Sources of Personal Information

We collect your PI directly from you, automatically from your device or vehicle, or from third parties to whom you direct to disclose information to us.

Processing of Sensitive Personal Information

We process sensitive personal information (precise geolocation) for purposes specified in section 7027 subsection (m) of the California Consumer Privacy Act Regulations.

Subject to restrictions and obligations of the CCPA, our service providers may also use your PI for some or all of the business purposes identified in this Notice as well as those disclosures noted in Section 5. Our service providers may themselves engage services providers or subcontractors to enable them to perform services for us. That subcontracting is, for purposes of clarity, an additional business purpose for which we are providing you with this Notice.

CCPA Do Not Sell or Share

• Within the past twelve (12) months, we did not “sell” or “share” PI, and we will not sell or share your PI collected by us during a period in which we did not offer you the opportunity to opt out of the sale or share, unless we first obtain your affirmative consent to do so.
• We may disclose your PI for the following purposes, which are not sales: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) disclosures among our group companies; (iv) as part of a merger or asset sale; and (v) as otherwise required or permitted by applicable laws.

Consistent with the CCPA and our interest in the security of your PI, in response to a CCPA rights request from you, even if we are in possession of the following, we will not deliver to you a Social Security number; driver's license number or other government-issued ID number; financial account number; any health or medical identification number; an account password; security questions or answers in response to your security questions; or unique biometric data generated from measurements or technical analysis of human characteristics. However, you may be able to access some of this information yourself through your account if available and if you have an active account with us.

CCPA Right-to-Know Categories Request

You have the right to send us a request, no more than twice in a twelve (12)-month period, for any of the following for the period that is twelve (12) months prior to the request date:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The business or commercial purposes for our collecting your PI.
• The categories of third parties to whom we have disclosed your PI.
• A list of the categories of PI disclosed for a business purpose in the prior twelve (12) months and, for each, the categories of recipients, or that no disclosure occurred.
• A list of the categories of PI sold about you in the prior twelve (12) months and, for each, the categories of recipients, or that no sale occurred.

CCPA Specific Pieces of PI Request

You have the right to make or obtain a transportable copy, no more than twice in a twelve (12)-month period, of your PI that we have collected in the period that is twelve (12) months prior to the request date and are maintaining.

CCPA Deletion Request

You may request that we delete your PI that we have collected directly from you and are maintaining. However, we may have a basis for retention of your PI under the CCPA. Our retention rights include (i) to complete transactions and services you have requested or that are reasonably anticipated; (ii) for security purposes; and (iii) for legitimate internal business purposes, including to maintain business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement. Note also that we are not required to delete your PI that we did not collect directly from you.

CCPA Correction Request

You may request that we correct your inaccurate PI maintained by us, taking into account the nature of the personal information and the purposes of the processing of the personal information.

CCPA Right not to Receive Discriminatory Treatment

If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us.

Making CCPA Requests

To make a CCPA request, you or an Authorized Agent (as indicated below) may call us at (855) 976-2844, email us here, or write us at Kawasaki Motors, Ltd. 1-1, Kawasaki-cho, Akashi, Hyogo, 673-8666, Japan (Attn: CCPA Request).

Authorized Agent Request

As permitted by the CCPA, any request submitted to us is subject to an identification and verification process, and confirmation of the agent's authority, which may include attestation under penalty of perjury. Absent a power of attorney, we will also require the consumer to verify his or her own identity. We may verify identity based on matching information you provided with data we have maintained on you in our systems. This data could include email address, mailing address, or phone number.

Third-Party Marketing and Other California Privacy Rights

Shine the Light

We provide California residents with the option to opt in to sharing of “personal information,” as defined by California's “Shine the Light” law, with third parties, other than our affiliates, for such third parties' own direct marketing purposes. California residents may prospectively withdraw that consent, and/or request information about our compliance with the Shine the Light law, and obtain a disclosure of third parties we have shared information with in accordance with the law for those companies direct marketing purposes and the categories of information shared. To obtain such information, email us here , or contact us by mail at Kawasaki Motors, Ltd. 1-1, Kawasaki-cho, Akashi, Hyogo, 673-8666, Japan (Attn: California Privacy Rights Request). Requests must include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through the provided email address or postal address. As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.

California Minors

The App is intended for a general audience and not directed to children less than thirteen (13) years of age.

If United Kingdom residents use the App, the following additional applies in addition to the information for European Economic Area and United Kingdom residents under Section 11 above:

United Kingdom Children

The App is intended for a general audience and not directed to children less than eighteen (18) years of age.

If Netherlands residents use the App, the following additional applies in addition to the information for European Economic Area and United Kingdom residents under Section 11 above:

In deviation from Section 4: Depending on the way your personal data is processed, it may also be transferred outside the EU/EEA. In these cases, we ensure that an adequate level of data protection exists before transferring your personal data. This means that via EU standard contractual clauses or an adequacy decision, a level of data protection is achieved that is comparable to the standards within the EU.

If Spanish residents use the App, the following additional data protection information apply:

In reference to

17.1 Section 7: Insofar as we process your personal data for the pursuit of our legitimate interests and there are grounds based on your particular situation. Users have the right to request information about the balancing test carried out by us in order to assess the validity of such legal basis.

17.2 Section 8: At the end of the retention period, we would store your data, duly blocked, during the prescription periods of the legal obligations we are subject to and the potential liabilities that might arise from the processing of your personal data. Afterwards, we will take steps to delete your personal data or hold it in a form that no longer identifies you.

If you are a resident of Vietnam, the following regulations apply.

18.1 Regarding Section 2: The personal information we collect is as follows:

1. Basic personal information data:
   • Birth year
   • Gender
   • Other information as mentioned in Section 2 except for the information in (b) below.
2. Highly confidential personal information data:
   • Location information (Note: This is highly confidential personal information.)

18.2 Regarding Section 5: In addition to Section 5, the following cases also apply:

1. In an emergency, it is necessary to immediately process relevant personal data to protect the life and health of the data subject or other people.
2. Disclose personal data in accordance with the law.
3. Processing data of competent state agencies in case of emergency situations related to national defense, national security, social order and safety, major disasters, dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; prevent and combat riots, terrorism, prevent and combat crimes and violations of the law according to the provisions of law.
4. Fulfill the data subject's contractual obligations with relevant agencies, organizations and individuals according to the provisions of law.
5. Serving the activities of state agencies regulated by specialized laws, etc.

18.3 Regarding Section 7: In addition to the content in Section 7, the following cases are also included.

1. The right to consent or not consent to the processing of your personal data, unless otherwise provided by law.
2. You have the right to withdraw your consent, unless otherwise provided by law.
3. To delete or request deletion of your personal data, unless otherwise provided by law.
4. Be required to limit the processing of your personal data to 72 hours after the data subject's request, unless otherwise provided by law.
5. To request the Data Controller to provide you with your personal data, unless otherwise provided by law.
6. To object to the Data Controller processing your personal data within 72 hours after receiving the request in order to prevent or limit the disclosure of personal data or use for advertising or marketing purposes, except in cases where the law provides otherwise .
7. Have the right to complain, denounce or sue according to the provisions of law.
8. Have the right to request compensation for damages according to the provisions of law when there is a violation of regulations on protecting your personal data, unless the parties have otherwise agreed or the law has other provisions.
9. Have the right to self-protect according to the provisions of civil law , other relevant laws or request competent agencies or organizations to do so.

18.4 Regarding Section 8: Data processing start and end times are as follows:

Data processing begins: After “agree” to the privacy policy (privacy notice)

Termination of data processing: upon user request or when our service ends.

18.5 For each of the above items, the following further applies:

User obligations:

• Protect your personal data; Request other relevant organizations and individuals to protect their personal data.
• Respect and protect the personal data of others.
• Provide complete and accurate personal data when agreeing to process personal data.
• Participate in propagating and disseminating personal data protection skills.
• Implement legal regulations on personal data protection and participate in preventing and combating violations of personal data protection regulations.

Consequences may occur due to unexpected damage during data processing:

• Data leakage due to cyber attacks, hackers, viruses, etc.
• Data is stolen to commit illegal acts.
• Competent state agencies request data to serve investigation activities, state management work, etc. according to the provisions of law.

For minors in Vietnam

This application is intended for general use and is not intended for children under 18 years of age