LAST UPDATED: 04.12.2023

Content

1. Introduction

2. Collected Data

2.1 Collected Data Account Registration

2.2 Collected Data in relation with Websites in general

2.3 Collected Data in relation with Motohub Website

2.4 Data Collection: App

2.4.1 Collection and storage of App usage data

2.4.2 App Performance Data

2.5 Collected Data: Rider Feature

2.6 Collection of weather data from other sources (information according to Art 14 GDPR)

2.7 Collected Data: Navigation Feature

2.8 Sharing of personal data with other users – real time route sharing

2.9 Collection of traffic data from other sources (information according to Art 14 GDPR)

2.10 Collected Data: Mobility Feature

2.11 Cookies

2.12 Collected Data: Events / Consumer Activations

2.13 Collected Data: Purchase of Physical Products in a Web Shop

2.14 Collected Data: Marketing Communication

2.15 Collected Data: Requests and Contact

2.16 Collected Data: Bike

3. Recipient Categories

4. Automated individual decision making

5. Data Retention

6. Data Security

7. Your rights

7.1 Revocation of your consent to data processing

7.2 Right to object to data processing in specific cases and to direct advertising

7.3 Right to file a complaint with the competent supervisory authority

7.4 Information, erasure and rectification

7.5 Right to data portability

7.6 Right to restriction of processing

8. Contact

9. Specific data protection regulations for certain countries

9.1 California

9.2 Australia

 

1.     Introduction

This Privacy Policy (“Policy”) informs you on how the company of the Pierer Industrie AG Group that acts as controller (“Controller”, “we”, “us”, “our”) collects and processes personal data about you (“Personal Data”, “Data”) when you use and/or visit any digital property (“Digital Property”) including but not limited to the KTMconnect, Ride Husqvarna and GasGas App (each an “App”) or one of our websites (“Website”), buy products, attend or participate in one of our events or participate in a promotion.

The Controller is the entity that is named in the imprint of the visited Digital Property respectively, if the use of the Digital Property requires a registration, the respective entity of the Pierer Industry Group which operates the respective Digital Property. We respect and protect the privacy of all our Digital Property users (and adhere strictly to the regulations under data protection law in the jurisdiction where you are located. Personal data will be collected only to the extent required. Under no circumstances will the personal data stored be sold.

2.     Collected Data

2.1       Collected Data Account Registration

When registering an account with Pierer Industrie AG, Edisonstraße 1, 4600 Wels, Austria, you have to provide an email address and password in order to use specific Digital Properties. The mandatory data requested during registration must be provided in full. Otherwise, we will refuse registration. We process your Personal Data in order to take steps at your request prior to entering into a contract and/or for the performance of the corresponding contract (Art 6 para 1 lit b GDPR).

When you use the Digital Properties with your account, we will furthermore store in your account the Personal Data which the respective Controller collects according to this Policy. These Personal Data will be processed based on our legitimate interests and/or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR). We have an interest in transmitting Personal Data within the Pierer Industry Group for internal administrative purposes. Your interest in confidentiality recedes.

2.2       Collected Data in relation with Websites in general

When you visit one of our Websites, the following electronic communication metadata is processed and then stored in anonymized form:

• Browsertype,
• Operating System,
• Country,
• Date,
• Time and duration of access,
• IP address and pages visited on our website including entry and exit pages,

This data may be evaluated anonymously for statistical purposes.

These Personal Data will be processed based on our legitimate interests and/or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR). We have an interest in processing this Data in order to be able to provide the Websites. Your interest in confidentiality recedes.

2.3       Collected Data in relation with Motohub Website

We process mandatory data (your first and last name, your email address) for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of the platform accessible under www.motohub.io (“Motohub”). Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations. By submitting non-mandatory data (e.g. sex, phone number, country, ZIP code, address, language, height, weight, weight equipment road, weight equipment offroad) you request additional parts of the service. Therefore, if you provide us with non-mandatory data, we use it for the fulfilment of our contractual obligations to provide you with those requested services.

When Motohub is used, the following electronic communication metadata is stored in anonymized form:

• Browsertype,
• Operating System,
• Country,
• Date,
• Time and duration of access,
• IP address and pages visited on our website including entry and exit pages,
• Data, that you enter via our contact form

This data may be evaluated anonymously for statistical purposes.

2.4      Data Collection: App

We process mandatory data (your email address, your first and last name) for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of this App. We process not mandatory data (gender, profile picture, nickname, rider number, skill level, body weight, gear weight, preferred dealer, owned motorcycles, your individual engine and suspension settings) based on your consent (Art 6 para 1 lit a GDPR).

2.4.1      Collection and storage of App usage data

When the App is used, the following electronic communication metadata is stored in anonymised form: IP address, date and time of access, ID of the feature used, errors happening in the App, date and time of App errors. The data can be evaluated anonymously for statistical purposes.

Data provided by you will be processed by us for the purpose of contract fulfilment, for example for the implementation of a competition or other features of the App (cf. Art 6 para 1 lit b GDPR), to process your enquiries, notify you of changes or improvements of products or services which could affect you or to fulfil other legal obligations (cf. Art 6 para 1 lit c GDPR) and for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR). The App publisher has an interest in the technically error-free display and optimisation of its App. As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the App. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the respective App.

2.4.2      App Performance Data

The information below is required for the App to run. The App automatically collects and caches information about unexpected App behaviour, especially crashes. At certain times this data is automatically synchronised with the Firebase back-end service in California, USA. It also collects statistics on App usage. This allows to improve the App with future releases.

This data is collected in case of unexpected behaviour:

• IP-address of the device (anonymised)
• Information about the device, such as: device ID, model and device type, name and version of the operating system, settings and language of the device
• Version and functionality of the App
• Crash stack traces
• Time of failure

This data is collected for App performance:

• IP-address of the device (anonymised)
• Timestamp
• Motorcycle article ID
• Error code (on failed interaction),
• VIN
• User interaction with App

This data is not merged with other data sources.

The collection of this data is based on Art 6 para 1 lit f GDPR. The App publisher has an interest in the technically error-free display and optimisation of its App. As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the App. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the respective App.

2.5       Collected Data: Rider Feature

We process mandatory data (nickname) for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR). Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations.

Non-mandatory data is not necessary for the use of the basic functionalities of the Rider. By submitting non-mandatory data, you request additional parts of the service. Therefore, if you provide us with non-mandatory data as listed below, we use it for the fulfilment of our contractual obligations to provide you with the Rider functionalities:

Profile Information

• Profile picture

Activity data

• Date
• Time
• GPS Position data
• Acceleration
• Run hours
• Speed
• Engine speed
• Throttle position
• Gear position
• Water temperature
• Atmospheric pressure
• Ignition timing
• Engine mapping
• Traction control mode
• Mapswitch mode
• Information about technical malfunctions of different sensors (crank sensor, fuel pump, rollover sensor, throttle position sensor, etc).

Location data

• We process your geo location data when you use the services of KTMconnect, Ride Husqvarna and GasGas Rider and you have manually activated the logging function on your motorcycle or have set the KTMconnect Ride Husqvarna and GasGas Rider on automated logging. If you do not log your rides, we do not track your location. You can disable tracking at any time if you do not activate the manual logging function on your motorcycle or turn off the automated logging in KTMconnect, Ride Husqvarna and GasGas Rider. We will then not track your location, but in this case, the data analysis function of KTMconnect, Ride Husqvarna and GasGas Rider will not work.

Content You Share with us

• Track setup data
• Pictures uploaded by you

Session data

• Motorcycle used for the ride
• Notes

If you do not want to provide activity data, do not connect the App with the CCU (Central Communication Unit) of your motorcycle. Please note, that if you do not provide activity data, the data analysis function of KTMconnect, Ride Husqvarna and GasGas Rider will not work.

The processing of this data is based on the fulfilment of our contractual obligations to provide you with the Rider functionalities.

In addition, we further process your data listed above for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:

• for the purpose of asserting and defending any legal claims,
• to prevent cases of abuse and to block user accounts that violate the terms of use of the KTMconnect, Ride Husqvarna and GasGas Rider and
• for anonymizing data collected in the KTM connect App and any additional Feature in the App that you might be using so that this anonymized data can be used by us and third parties (e.g. other PIERER Industrie group companies, suppliers, research institutions) for statistical evaluations to better understand how customers use our motorcycles, market research purposes and the improvement of our products. Once the data is anonymised it is no longer considered personal data relating to you. As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the Rider Feature. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the Rider Feature.

Data analysis

The following analyses, among others, are performed with your data:

Lap evaluation

The lap is analysed in terms of length, speed and driving behaviour. The analysed data is then displayed in various graphics. You will get information about the lap time, average speed, maximum and minimum speed, number of laps, lap distance, total distance driven, number of corners, average and sharpest corner, total duration, track segment, G-forces, engine speeds, throttle positions, gears, water temperature etc.

Jumping behaviour

In addition to the laps themselves, the jumps are also analysed. This means that, for example, the total air time, the jump distance and height, the speed the number of jumps and the longest jump can be displayed.

Recommendations

Based on the above analyses, KTMconnect, Ride Husqvarna and GasGas Rider gives you recommendations to improve your lap times and riding style. KTMconnect, Ride Husqvarna and GasGas Rider analyses your riding behaviour and shows which parts of the route were driven particularly efficiently and which were not. In addition, KTMconnect, Ride Husqvarna and GasGas Rider gives you tips on how you can improve your speed, riding style, etc.

Targets

The App can set targets for you to be reached like motorcycle seat time in a particular time period and can give you different target statuses.

Legal basis of data transfer and data analysis: If you provide us with activity, heartrate, location and track setup data, the processing of this data is based on the fulfilment of our contractual obligations to provide you with the Rider functionalities.

2.6       Collection of weather data from other sources (information according to Art 14 GDPR)

If you enable location tracking you request additional parts of the service. Therefore, the processing of this data is based on the fulfilment of our contractual obligations to provide you with the Rider functionalities.

We will collect the weather data below from that location on the day of your ride and link it to your track drives. We may receive data not directly from you but from the following sources:

data or data categories	Source	Publicly available	purpose
Weather data	NZN Labs, Inc	Yes	Enrich your track data with weather data from the date and location of your ride

 

2.7       Collected Data: Navigation Feature

KTMconnect, Ride Husqvarna and GasGas Navigation is a navigation feature, which can show you the best route from one point to the next. We would like to point out that there are three different types of the Navigation Feature:

• Basic free
• Basic for one-time payment
• Premium subscription

These different types of the Navigation Feature have different functionalities.The Basic versions (free and one-time-payment) are bound to the VIN. Therefore, you can only use them for one bike. The Premium subscription is independent from the VIN, but is bound to the mobile phone and can be used for several vehicles.

When you activate the Navigation Feature the following data will be processed as described below, depending on the package purchased. Please note, that if you activate or purchase the Basic free or Basic one-time-payment version you will be granted a two-week trial period for the Premium version of the Feature. This therefore means that during the first two weeks different data will be processed from you than afterwards (see below).

Basic versions (free and one-time-payment)

Bike Information

• VIN Number (mandatory)

Location data

• Geo location (mandatory)

Mobile Device Information

• Mobile Device Unique Identifier (UUID)

Premium version (subscription)

Profile Information

• IP address of your mobile phone (mandatory)

Location data

Geo location (mandatory)

We process your data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of this App. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations.

2.8       Sharing of personal data with other users – real time route sharing

This chapter only applies to you if you have the premium version of the KTMconnect, Ride Husqvarna and GasGas Navigation. With real time route sharing you can share your current location and your currently planned route with others by sharing the link created in the App with the desired persons. The following data will then be shared:

• Current location
• Computed time of arrival
• Remaining distance to the destination
• Textual representation of destination

This data will be updated every 30 seconds and can be seen by those to whom you send the link, which means that KTMconnect, Ride Husqvarna and GasGas user but also other people can open the link. Please note that the link can also be passed on by these persons and therefore be careful to whom you send the link. The link expires as soon as the trip is completed, the driver cancels the navigation or the App is closed.

We process your data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of this App. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations.

2.9       Collection of traffic data from other sources (information according to Art 14 GDPR)

If you have purchased the Premium Package, you will receive the latest traffic data. To provide this feature, we collect the traffic data of your current environment. We may receive data not directly from you but from the following sources:

Data or data categories	Source	Publicly available	purpose
Traffic data	HERE Service	No	to inform you about the current traffic situation

2.10    Collected Data: Mobility Feature

KTMconnect, Ride Husqvarna and GasGas Mobility Service is a roadside assistance that helps you in the event of a breakdown. Thanks to a dense and professional assistance network, breakdowns are no longer a headache – the KTM Assistance Center, which is operated by ARC Europe (for further information see point 3.2 below) is on hand 24 hours a day, seven days a week, 365 days a year, throughout Europe. For the exact functionality of this feature, please read the Terms of Use.

The following data will be collected, stored, analysed or otherwise processed as described below:

Profile Information

• Name / Surname (not mandatory)
• E-Mail address (not mandatory)
• Phone number (mandatory)

Bike Information

• Plate (not mandatory)
• VIN number or date of delivery of the motorcycle or date of the last service (in case the VIN cannot be found in the VIN Database and the motorcycle is not older than 14 days) (mandatory)
• Type (mandatory)
• Model (mandatory)

Incident Information

• Information about what happened (mandatory)
• Description of the incident (not mandatory)

Location data

• Geo location, (if you use the App, it will automatically be inserted in your request form but you can change your location if you want to) (mandatory)
• Comment on location (not mandatory)

Further data in roadside incident cases

In a roadside incident case, it is possible that you will need to provide further data to third parties like local breakdown services that is necessary for the processing of the request. This could include, for example data such as private address, nationality, gender, breakdown address, credit card or bank details, hotel booking information, data/place of birth, data concerning personal document (ID, passport etc.) which are necessary for the booking of hotels, the towing of your vehicle, your transport or other services you need. However, we do not receive and therefore do not process this data ourselves, which you may entrust to third parties or processors. However, this does not preclude processing by these third parties or processors on our behalf if they receive any of the aforementioned data from you. In special circumstances, this data may also be given to Pierer Industries AG. This could be, for example, if the costs for the corresponding service are particularly high or there are other complications in the processing.

Some data categories are mandatory in order to use the App and its feature as intended (see above), while others are not. We process mandatory data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract for the use of the "KTMconnect, Ride Husqvarna and GasGas Mobility Service", and as necessary for this service specifically requested by you. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations. We process the not mandatory data based on your consent (Art 6 para 1 lit a GDPR). Please see the information above on how to activate and deactivate the collection of non-mandatory data.

In addition, we further process your data listed above for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:

• for the purpose of asserting and defending any legal claims,

• to prevent cases of abuse and to block user accounts that violate the terms of use of the KTMconnect, Ride Husqvarna and GasGas Mobility Service, and
• for anonymizing data collected in the KTM connect App and any additional Feature in the App that you might be using so that this anonymized data can be used by us and third parties (e.g. other PIERER Industrie group companies, suppliers, research institutions) for statistical evaluations to better understand how customers use our motorcycles, market research purposes and the improvement of our products. Once the data is anonymised it is no longer considered personal data relating to you.

As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the Digital Property. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the Digital Property.

2.11    Cookies

Cookies may be used on certain Digital Properties. A cookie is a small data record that can be stored on your hard disk. This data record is generated by the web server with which you have established a connection through your device, and is then sent to you. The cookie enables you to be recognized when visiting the Digital Property without having to enter data again that you had previously entered. The default setting of most browsers is to automatically accept cookies. You can, however, reset your device to decline such cookies or to have them fully displayed including the necessary requirements for consent. You can also delete cookies from your system at any time. Find out how to do this here: aboutcookies.org

The processing of data through the use of absolutely necessary cookies is based on a legitimate interest according to Art. 6 para 1 lit f GDPR in the technically flawless provision of our services.

The processing of personal data through the use of other cookies is based on consent in accordance with Art. 6 para 1 lit a GDPR. Consent can be revoked at any time for the future. If such cookies are used for analysis and optimization purposes, we will inform you separately in this privacy policy and obtain consent in accordance with Art. 6 para 1 lit a GDPR.

To the extent that the collection and storage of data with cookies is lawful, this occurs exclusively in an anonymous form, so that it is not possible to draw any conclusion about you as a natural person.

You can change the settings of your set cookies at any time here:

COOKIE SETTINGS

The cookies below are currently used on Digital Properties for the following purposes:

A cookie is a small data package (text file) that your device stores on the instruction of a visited Digital Property in order to "remember" information about you, such as your language settings or login information. These cookies are set by us and are called first-party cookies. We also use third-party cookies that originate from a domain other than that of the Digital Property you are visiting. We use these cookies to support our advertising and marketing activities. In particular, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

Cookie Subgroup	Cookies	Cookies used	Lifespan
media.pierernewmobility.com	JSESSIONID	First Party	Session
pierernewmobility.com	OptanonConsent , OptanonAlertBoxClosed	First Party	364 Days, 364 Days

 

Performance Cookies

Cookie Subgroup	Cookies	Cookies used	Lifespan
pierernewmobility.com	_ga , _ga_xxxxxxxxxx	First Party	729 Days, 729 Days

2.12      Collected Data: Events / Consumer Activations

You can enter into a contract with us in relation to events (e.g. purchase tickets) or consumer activations (e.g. sweepstakes, prize draws, promotions and/or competitions). For this purpose, we process the respective Personal Data that you provide to us in each case.

In general, the following Personal Data will be mandatorily collected:

• First and last name
• Language
• Street and Number
• Postal code
• City
• Country
• Date of birth
• E-mail address.

We process your personal data in order to take steps at your request prior to entering into a contract and/or for the performance of the corresponding contract (Art 6 para 1 lit b GDPR).

2.13       Collected Data: Purchase of Physical Products in a Web Shop

You can enter into a contract with us when making a purchase in a web shop. For this purpose, we process the respective Personal Data that you provide to us in each case.

In general, the following Personal Data will be mandatorily collected:

• First and last name
• Language
• Street and Number
• Postal code
• City
• Country
• Date of birth
• E-mail address.

We process your personal data in order to take steps at your request prior to entering into a contract and/or for the performance of the corresponding contract (Art 6 para 1 lit b GDPR).

2.14       Collected Data: Marketing Communication

Provided that you give us your consent (within the meaning of Art 6 para 1 lit a GDPR), we process your data in order to inform you about our products and/or services at regular intervals.

For the administration of the newsletter subscribers and the sending of the newsletter, the following data from you will be processed:

• Email address
• First and last name
• time of registration for the newsletter
• Country
• Language.

Optional following data can be provided:

• Street and number
• Postal code
• City
• Date of birth.

To analyse the newsletters sent, the following data is collected from you when you read the newsletter and processed further:

• IP address (of the device on which the newsletter is read)
• preferences when reading the newsletter (click behaviour)
• blocking and marking as spam
• Time of opening the newsletter.

If you do not wish to provide this information, please do not subscribe to the newsletter. You can unsubscribe from the newsletter at any time.

2.15       Collected Data: Requests and Contact

If you send us any requests (e.g. by contact form, email) the contact details that you provide there, will be stored by us for the purpose of processing the request and if any follow-up questions should arise.

This data is processed on the basis of Art 6 para 1 lit b GDPR, to the extent that your request is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art 6 para 1 lit f GDPR) or on your consent (Art 6 para 1 lit a GDPR), provided that this was requested. We will not pass on this data without your consent.

The App extends this data with additional information in the service ticket to better help with the request:

• App version
• Language
• Motorcycle
• Optional: attachments added by the user
• Usage logs
• User questions, requests or messages
• Email address
• Phone model.

As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests responding to your requests. Your interest in confidentiality recedes. Otherwise, we would not be able to respond to your requests.

2.16       Collected Data: Bike

We process data related to your bike in order to provide general services (e.g. maintenance, software/firmware updates, recalls, product and service improvements).

The following data will be collected, stored, analysed or otherwise processed as described below:

Profile Information

• Name / Surname (not mandatory)
• E-Mail address (not mandatory)
• Phone number (mandatory)
• IP address (mandatory)
• Respective dealer (mandatory)

Bike Information

• Plate (not mandatory)
• VIN number or date of delivery of the motorcycle or date of the last service (in case the VIN cannot be found in the VIN Database and the motorcycle is not older than 14 days) (mandatory)
• Type (mandatory)
• Model (mandatory)
• Software / firmware version (mandatory)
• Progress details (e.g. update successful, update paused etc.; mandatory)
• Any information in case of an unsuccessful update (mandatory).

 

We process mandatory data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the the fulfilment of the respective sales contract and as necessary for the respective service specifically requested by you. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations. We process the not mandatory data based on your consent (Art 6 para 1 lit a GDPR). Please see the information above on how to activate and deactivate the collection of non-mandatory data.

In addition, we further process your data listed above for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:

• for improving our product and services and
• for providing maintenance support and offers.

 

As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the Digital Property. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the Digital Property.

In addition, we further process your data listed above for the purpose of complying with legal obligations (Art 6 para 1 lit c GDPR), namely:

• to monitor product and services and
• to handle recalls.

3.     Recipient Categories

As part of our service provision, we might transfer personal data to other companies. We might transfer personal data to other companies within and/or outside our group of companies, including but not limited to external service providers as part of our services. In such a case, we contractually obligate these service providers to exercise the same care in processing personal data as we do ourselves.

In some cases, we may transfer personal data to recipients in third countries (see in each case the corresponding statement within our privacy statement). Third countries are countries outside the European Union (“EU”) and outside the European Economic Area (“EEA”). These third countries also include the USA.

In the USA, there is no comparable level of data protection compared to the data protection level within the EU or within the EEA. In particular, it is possible that government agencies might access personal data without us or you are becoming aware of this. Legal prosecution may not be promising.

The legal basis for such a data transfer is generally your consent (Article 49 (1) sentence 1 (a) GDPR) or a respective contract performance (Article 49 (1) sentence 1 (b) GDPR) or the adequacy decision of the EU Commission (Article 45 (1) GDPR) or the use of EU standard contractual clauses (Article 46 (2) (c) GDPR; “SCC”). You can access these SCC here:

https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

We may also use another legal basis for a data transfer to a third country, in compliance with the requirements of the applicable data protection law.

4.     Automated individual decision making

We would like to inform you that no data processing within the meaning of Art 22 GDPR takes place. This means that we do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you; any decision with equivalent effect is made by a natural person.

5.     Data Retention

We delete your personal data when no further storing is necessary with regard to the respective data processing purpose, and we do not need to comply with a statutory provision regarding the retention of certain personal data. If we cannot delete your personal data, we will restrict further processing of such personal data. Furthermore, the respective storage period also depends on the statutory limitation periods.

 6.     Data Security

We take appropriate technical and organizational security measures to protect the personal data we process against accidental or intentional manipulation, loss, destruction or against unauthorized access.

We use technical and organizational measures to ensure the confidentiality of your personal data and to protect it against manipulation, loss and destruction. The storage and disclosure of personal data are subject to strict security procedures. We train our corresponding employees with regard to data protection law. Our employees only access personal data to the extent necessary.

7.     Your rights

You may have the following rights in relation to your Personal Data, subject to applicable law and in certain circumstances. Please refer to section 9 if you are based in California or Australia.

7.1     Revocation of your consent to data processing

Certain data processing operations are only possible with your explicit consent. You can revoke consent you have already given at any time. To do this, an informal notification to us by e-mail or via post is sufficient (see contact details below). The legality of the data processing that took place up until the revocation remains unaffected by the revocation.

7.2     Right to object to data processing in specific cases and to direct advertising

You have the right, on grounds relating to your particular situation, to object at any time to processing of your data that is necessary to protect our legitimate interests or those of a third party. In the event of an objection, we will no longer process your data unless the processing serves the assertion, exercise or defence of legal claims or we can demonstrate compelling legitimate grounds for the processing which override your interests. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes (Art 21 GDPR).

7.3     Right to file a complaint with the competent supervisory authority

You have the right to lodge a complaint with the competent data protection authority.

7.4     Information, erasure and rectification

In accordance with Art 15 GDPR, you have the right to request information which personal data is processed by us free of charge at any time. The right of access also includes the right to obtain a copy of the data, provided that this does not adversely affect the rights and freedoms of other persons (Art 15 GDPR).

Furthermore, you have the right to request the correction or completion of incorrect or incomplete data (Art 16 GDPR).

In addition, you can request the deletion of your data at any time (Art 17 DSGVO). Please note that we cannot comply with an erasure request if the processing (storage) is necessary for the fulfilment of a legal obligation (e.g. legal retention obligations) or if we are entitled to do so due to overriding interests (e.g. assertion or defense of certain legal claims).

7.5     Right to data portability

Additionally, you have the right to receive the processed data in a structured, common and machine-readable format. The right to data portability only exists if the data processing is based on your consent or on a contract (Art 20 GDPR).

7.6     Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do this, you can contact us at any time at the address specified in point 5. The right to restriction of processing exists in the following cases:

• If you contest the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the verification process, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data is/has been unlawful, you may request that we restrict the processing instead of erasing the data.
• If we no longer need your personal data, but you do need it to exercise, defend or establish legal claims, you have the right to request the restriction of the processing of your personal data instead of erasing it.
• If you have lodged an objection under Art 21 para 1 GDPR, your interests must be weighed up against our interests. Until it has been established whose interests are overriding, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may, except for storage, only be processed with your consent or for the purpose of establishing, exercising or defending legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

8.     Contact

If you have any questions that are not answered by this Privacy Policy, or if you require more detailed information on a particular point, please feel free to contact us. You can find the contact data in the imprint section of the respective Digital Property, or, as otherwise provided by the provider of the website, as indicated in the Digital Property.

9.     Specific data protection regulations for certain countries

This App including its additional features is used in various countries. We would therefore like to draw your attention to the specific data protection regulations in the respective countries.

9.1     California

This section contains additional information for residents of the State of California in the United States.

Personal Information We Collect

In the last 12 months, we have collected the following categories of personal information that identify you or your household:

• Identifiers, such as your name, IP address, email address, or phone number;
• Protected classification characteristics, such as gender;
• Commercial information, such as records of personal property, products or services purchased, or other purchasing or consumption histories or tendencies;
• Biometric information, such as your physical characteristics;
• Internet/network information, such as information about your interaction with the App;
• Geolocation data, such as information about your physical location or movements; and
• Audio, electronic, visual, thermal, olfactory, or similar information, such as profile pictures.

Use & Disclosure of Personal Information

We use the personal information collected for the business purposes described in section 3 (“Data collection and data processing in this App”) above.

In the last 12 months, we have disclosed the following categories of personal information to our affiliates and business partners for a business purpose:

• Identifiers
• Protected classification characteristics
• Internet/network information
• Geolocation data

• Audio, electronic, visual, thermal, olfactory, or similar information

The California Consumer Privacy Act (“CCPA”) considers certain disclosures of personal information to third parties “sales” even when no money is exchanged. We do not sell your personal information as that term is defined in the CCPA and do not have actual knowledge that we sell the personal information of any individual under 16 years of age.

Your California Privacy Rights

• Right to access personal information. You may be entitled to receive the specific pieces of your personal information we have about you.
• Right to disclosure. You may be entitled to certain information related to personal information about you, such as the categories of personal information we collected, the sources from which we collected personal information, the purposes for which we collected personal information, and the categories of personal information that we disclosed for a business purpose in the 12 months preceding your request.
• Right to deletion. You may be entitled to request that we delete the personal information that we have collected from you.

• Right to non-discrimination. You have the right to not to receive discriminatory treatment for exercising these rights.

To exercise your California Privacy Rights, you can submit your request by emailing us at ccpa@ktmnorthamerica.comor by calling our toll-free telephone number [1-888-671-4619].

We will need to verify your request to exercise your California Privacy Rights. We generally are able to verify such requests by matching the information you provide with information we have collected about you. However, you may be asked to provide additional personal information for verification purposes. We may be unable to fully process your rights if we are unable to verify your request to a reasonable or reasonably high degree of certainty.

You are permitted to use an authorised agent to submit requests on your behalf if we can verify the authorised agent’s authority to act on your behalf (such as pursuant to a power of attorney valid under the laws of California or if you have separately verified your identity or the relevant authorisation with us).

9.2     Australia

We are committed to protecting your privacy in accordance with the Australian Privacy Principles (“APPs”) contained in the Privacy Act 1988 (Cth) (“Privacy Act”). For the avoidance of doubt, references to “processing” in this Privacy Policy includes the collection, use and/or disclosure of personal data (as the context requires).

As noted above, we share your personal data with a variety of third parties located in various jurisdictions such as in the European Union and United States of America. Under these circumstances, we will take reasonable steps to ensure any third parties will handle your personal data in accordance with the APPs.

Under the Privacy Act (APPs 12 and 13) you have the right to ask for access to personal data that we hold about you and request the correction your personal data. You can ask for access or correction of your personal data by contacting us (see point 5). We will endeavour to respond to your request within 30 days. We will ask you to verify your identity before we give you access to your information or correct it, and we will try to make the process as simple as possible. If we refuse to give you access to, or correct, your personal data, we must notify you in writing setting out the reasons.

If you have any queries or complaints about this Privacy Policy or consider there has been any breach of the APP, please contact us in writing (see section 7 above). If you are dissatisfied with the outcome of the complaint or the way in which the complaint was handled, then you may contact the Office of the Australian Information Commissioner (OAIC).