2.1 Collected Data Account Registration

When registering an account with Pierer Industrie AG, Edisonstraße 1, 4600 Wels, Austria, you have to provide an email address and password in order to use specific Digital Properties. The mandatory data requested during registration must be provided in full. Otherwise, we will refuse registration. We process your Personal Data in order to take steps at your request prior to entering into a contract and/or for the performance of the corresponding contract (Art 6 para 1 lit b GDPR).

When you use the Digital Properties with your account, we will furthermore store in your account the Personal Data which the respective Controller collects according to this Policy. These Personal Data will be processed based on our legitimate interests and/or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR). We have an interest in transmitting Personal Data within the Pierer Industry Group for internal administrative purposes. Your interest in confidentiality recedes.

2.2 Collected Data in relation with Websites in general

When you visit one of our Websites, the following electronic communication metadata is processed and then stored in anonymized form:

• Browsertype,
• Operating System,
• Country,
• Date,
• Time and duration of access,
• IP address and pages visited on our website including entry and exit pages,

This data may be evaluated anonymously for statistical purposes.

These Personal Data will be processed based on our legitimate interests and/or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR). We have an interest in processing this Data in order to be able to provide the Websites. Your interest in confidentiality recedes.

2.3 Collected Data in relation with the user account platform

We process mandatory data (your first and last name, your email address) for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of the user account platform. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations. By submitting non-mandatory data (e.g. sex, phone number, country, ZIP code, address, language, height, weight, weight equipment road, weight equipment offroad) you request additional parts of the service. Therefore, if you provide us with non-mandatory data, we use it for the fulfilment of our contractual obligations to provide you with those requested services.

When the user account platform is used, the following electronic communication metadata is stored in anonymized form:

• Browsertype,
• Operating System,
• Country,
• Date,
• Time and duration of access,
• IP address and pages visited on our website including entry and exit pages,
• Data, that you enter via our contact form

This data may be evaluated anonymously for statistical purposes.

2.4 Data Collection: App

We process mandatory data (your email address, your first and last name) for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of this App. We process not mandatory data (gender, profile picture, nickname, rider number, skill level, body weight, gear weight, preferred dealer, owned motorcycles, your individual engine and suspension settings) based on your consent (Art 6 para 1 lit a GDPR).

2.5 Collected Data: Rider Feature

We process mandatory data (nickname) for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR). Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations.

Non-mandatory data is not necessary for the use of the basic functionalities of the Rider. By submitting non-mandatory data, you request additional parts of the service. Therefore, if you provide us with non-mandatory data as listed below, we use it for the fulfilment of our contractual obligations to provide you with the Rider functionalities:

Profile Information

• Profile picture

Activity data

• Date
• Time
• GPS Position data
• Acceleration
• Run hours
• Speed
• Engine speed
• Throttle position
• Gear position
• Water temperature
• Atmospheric pressure
• Ignition timing
• Engine mapping
• Traction control mode
• Mapswitch mode
• Information about technical malfunctions of different sensors (crank sensor, fuel pump, rollover sensor, throttle position sensor, etc).

Location data

• We process your geo location data when you use the services of the Rider Feature of the App and you have manually activated the logging function on your motorcycle or have set the Rider Feature of the App on automated logging. If you do not log your rides, we do not track your location. You can disable tracking at any time if you do not activate the manual logging function on your motorcycle or turn off the automated logging of Rider Feature of the App. We will then not track your location, but in this case, the data analysis function of the Rider Feature of the App will not work.

Content You Share with us

• Track setup data
• Pictures uploaded by you

Session data

• Motorcycle used for the ride
• Notes

If you do not want to provide activity data, do not connect the App with the CCU (Central Communication Unit) of your motorcycle. Please note, that if you do not provide activity data, the data analysis function of the Apps will not work.

The processing of this data is based on the fulfilment of our contractual obligations to provide you with the Rider functionalities.

In addition, we further process your data listed above for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:

• for the purpose of asserting and defending any legal claims,
• to prevent cases of abuse and to block user accounts that violate the terms of use of the Apps and
• for anonymizing data collected in the App and any additional Feature in the App that you might be using so that this anonymized data can be used by us and third parties (e.g. other PIERER Industrie group companies, suppliers, research institutions) for statistical evaluations to better understand how customers use our motorcycles, market research purposes and the improvement of our products. Once the data is anonymised it is no longer considered personal data relating to you. As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the Rider Feature. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the Rider Feature.

Data analysis

The following analyses, among others, are performed with your data:

Lap evaluation

The lap is analysed in terms of length, speed and driving behaviour. The analysed data is then displayed in various graphics. You will get information about the lap time, average speed, maximum and minimum speed, number of laps, lap distance, total distance driven, number of corners, average and sharpest corner, total duration, track segment, G-forces, engine speeds, throttle positions, gears, water temperature etc.

Jumping behaviour

In addition to the laps themselves, the jumps are also analysed. This means that, for example, the total air time, the jump distance and height, the speed the number of jumps and the longest jump can be displayed.

Recommendations

Based on the above analyses, the Rider Feature gives you recommendations to improve your lap times and riding style. The Rider Feature analyses your riding behaviour and shows which parts of the route were driven particularly efficiently and which were not. In addition, the Rider Feature gives you tips on how you can improve your speed, riding style, etc.

Targets

The App can set targets for you to be reached like motorcycle seat time in a particular time period and can give you different target statuses.

Legal basis of data transfer and data analysis: If you provide us with activity, heartrate, location and track setup data, the processing of this data is based on the fulfilment of our contractual obligations to provide you with the Rider functionalities.

2.6 Collection of weather data from other sources (information according to Art 14 GDPR)

If you enable location tracking you request additional parts of the service. Therefore, the processing of this data is based on the fulfilment of our contractual obligations to provide you with the Rider functionalities.

We will collect the weather data below from that location on the day of your ride and link it to your track drives. We may receive data not directly from you but from the following sources:

Data or data categories	Source	Publicly available	Purpose
Weather data	NZN Labs, Inc	Yes	Enrich your track data with weather data from the date and location of your ride

2.7 Collected Data: Navigation Feature

The Navigation Feature is a feature, which can show you the best route from one point to the next. We would like to point out that there are three different types of the Navigation Feature:

• Basic free
• Basic for one-time payment
• Premium subscription

These different types of the Navigation Feature have different functionalities.The Basic versions (free and one-time-payment) are bound to the VIN. Therefore, you can only use them for one bike. The Premium subscription is independent from the VIN, but is bound to the mobile phone and can be used for several vehicles.

When you activate the Navigation Feature the following data will be processed as described below, depending on the package purchased. Please note, that if you activate or purchase the Basic free or Basic one-time-payment version you will be granted a two-week trial period for the Premium version of the Feature. This therefore means that during the first two weeks different data will be processed from you than afterwards (see below).

Basic versions (free and one-time-payment)

Bike Information

• VIN Number (mandatory)

Location data

• Geo location (mandatory)

Mobile Device Information

• Mobile Device Unique Identifier (UUID)

Premium version (subscription)

Profile Information

• IP address of your mobile phone (mandatory)

Location data

• Geo location (mandatory)

We process your data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of this App. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations.

2.8 Sharing of personal data with other users – real time route sharing

This chapter only applies to you if you have the premium version of the Navigation Feature. With real time route sharing you can share your current location and your currently planned route with others by sharing the link created in the App with the desired persons. The following data will then be shared:

• Current location
• Computed time of arrival
• Remaining distance to the destination
• Textual representation of destination

This data will be updated every 30 seconds and can be seen by those to whom you send the link, which means that KTMconnect, Ride Husqvarna and GasGas user but also other people can open the link. Please note that the link can also be passed on by these persons and therefore be careful to whom you send the link. The link expires as soon as the trip is completed, the driver cancels the navigation or the App is closed.

We process your data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract of this App. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations.

2.9 Collection of traffic data from other sources (information according to Art 14 GDPR)

If you have purchased the Premium Package, you will receive the latest traffic data. To provide this feature, we collect the traffic data of your current environment. We may receive data not directly from you but from the following sources:

Data or data categories	Source	Publicly available	Purpose
Traffic data	HERE Service	No	To inform you about the current traffic situation

2.10 Collected Data: Mobility Feature

Mobility Service is a roadside assistance that helps you in the event of a breakdown. Thanks to a dense and professional assistance network, breakdowns are no longer a headache – the KTM Assistance Center, which is operated by ARC Europe (for further information see point 3.2 below) is on hand 24 hours a day, seven days a week, 365 days a year, throughout Europe. For the exact functionality of this feature, please read the Terms of Use.

The following data will be collected, stored, analysed or otherwise processed as described below:

Profile Information

• Name / Surname (not mandatory)
• E-Mail address (not mandatory)
• Phone number (mandatory)

Bike Information

• Plate (not mandatory)
• VIN number or date of delivery of the motorcycle or date of the last service (in case the VIN cannot be found in the VIN Database and the motorcycle is not older than 14 days) (mandatory)
• Type (mandatory)
• Model (mandatory)

Incident Information

• Information about what happened (mandatory)
• Description of the incident (not mandatory)

Location data

• Geo location, (if you use the App, it will automatically be inserted in your request form but you can change your location if you want to) (mandatory)
• Comment on location (not mandatory)

Further data in roadside incident cases

In a roadside incident case, it is possible that you will need to provide further data to third parties like local breakdown services that is necessary for the processing of the request. This could include, for example data such as private address, nationality, gender, breakdown address, credit card or bank details, hotel booking information, data/place of birth, data concerning personal document (ID, passport etc.) which are necessary for the booking of hotels, the towing of your vehicle, your transport or other services you need. However, we do not receive and therefore do not process this data ourselves, which you may entrust to third parties or processors. However, this does not preclude processing by these third parties or processors on our behalf if they receive any of the aforementioned data from you. In special circumstances, this data may also be given to Pierer Industries AG. This could be, for example, if the costs for the corresponding service are particularly high or there are other complications in the processing.

Some data categories are mandatory in order to use the App and its feature as intended (see above), while others are not. We process mandatory data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the fulfilment of the usage contract for the use of the

Mobility Service

of the App, and as necessary for this service specifically requested by you. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations. We process the not mandatory data based on your consent (Art 6 para 1 lit a GDPR). Please see the information above on how to activate and deactivate the collection of non-mandatory data.

In addition, we further process your data listed above for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:

• for the purpose of asserting and defending any legal claims,
• to prevent cases of abuse and to block user accounts that violate the terms of use of the Mobility Service of the App, and
• for anonymizing data collected in the KTM connect App and any additional Feature in the App that you might be using so that this anonymized data can be used by us and third parties (e.g. other PIERER Industrie group companies, suppliers, research institutions) for statistical evaluations to better understand how customers use our motorcycles, market research purposes and the improvement of our products. Once the data is anonymised it is no longer considered personal data relating to you.

As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the Digital Property. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the Digital Property.

2.11 Cookies

Cookies are used on Digital Properties, especially on our websites. A cookie is a small data record that can be stored on your hard disk. This data record is generated by the web server with which you have established a connection through your device, and is then sent to you. The cookie enables you to be recognized when visiting the Digital Property without having to enter data again that you had previously entered. The default setting of most browsers is to automatically accept cookies. You can, however, reset your device to decline such cookies or to have them fully displayed including the necessary requirements for consent. You can also delete cookies from your system at any time. Find out how to do this here: aboutcookies.org

Our Digital Properties only use first party cookies, i.e. the cookies are set exclusively by us or by a service provider (processor) on our behalf and no cookies are set by third parties for their own purposes (third party cookies).The processing of personal data through the use of other cookies is based on consent in accordance with Art. 6 para 1 lit a GDPR. Consent can be revoked at any time for the future. If such cookies are used for analysis and optimization purposes, we will inform you separately in this privacy policy and obtain consent in accordance with Art. 6 para 1 lit a GDPR.

The processing of data through the use of strictly necessary cookies is based on a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR to provide our services in a technically flawless manner.

If you have given us your consent to do so, we also use the cookies listed to collect and process further data for the following purposes and to pass them on to third parties for the purposes mentioned. No other cookies are set by us or by third-party providers for this purpose.

• Measurement of website performance
• Marketing
• Connection with social media

The processing of data for marketing purposes includes the transfer of data to our advertising partners. This data is used by these companies to create a profile of your interests and show you relevant adverts on other websites. They do not store personal data directly, but are based on a unique identification of your browser and internet device. If you do not allow this processing, you will experience less targeted advertising.

The processing of data for the purpose of connecting with social media includes the sharing of data with social media services so that you can share our content with your friends and networks. With this data, social media services are able to track your browser across other websites and build a profile of your interests. This may affect the content and messages you see on other websites. If you do not allow this processing, you may not be able to use or see these sharing tools.

We only pass on data to third parties in pseudonymised form, i.e. the recipients of the data cannot identify you. IP addresses are only passed on in truncated form.

The processing of personal data through the use of cookies for purposes other than those necessary for the provision of our services is based on consent in accordance with Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time with future effect. If data is processed for analysis and optimisation purposes using cookies, we will inform you separately in this privacy policy and obtain your consent in accordance with Art. 6 para. 1 lit. a GDPR.

You can change the settings of the cookies you have accepted at any time here:

The cookies below are currently used on Digital Properties for the following purposes:

JENTIS GmbH acts as a processor on our behalf.

2.12 Collected Data: Events / Consumer Activations

You can enter into a contract with us in relation to events (e.g. purchase tickets) or consumer activations (e.g. sweepstakes, prize draws, promotions and/or competitions). For this purpose, we process the respective Personal Data that you provide to us in each case.

In general, the following Personal Data will be mandatorily collected:

• First and last name
• Language
• Street and Number
• Postal code
• City
• Country
• Date of birth
• E-mail address.

We process your personal data in order to take steps at your request prior to entering into a contract and/or for the performance of the corresponding contract (Art 6 para 1 lit b GDPR).

2.13 Collected Data: Purchase of Physical Products in a Web Shop

You can enter into a contract with us when making a purchase in a web shop. For this purpose, we process the respective Personal Data that you provide to us in each case.

In general, the following Personal Data will be mandatorily collected:

• First and last name
• Language
• Street and Number
• Postal code
• City
• Country
• Date of birth
• E-mail address.

We process your personal data in order to take steps at your request prior to entering into a contract and/or for the performance of the corresponding contract (Art 6 para 1 lit b GDPR).

2.14 Collected Data: Marketing Communication

Provided that you give us your consent (within the meaning of Art 6 para 1 lit a GDPR), we process your data in order to inform you about our products and/or services at regular intervals.

For the administration of the newsletter subscribers and the sending of the newsletter, the following data from you will be processed:

• Email address
• First and last name
• time of registration for the newsletter
• Country
• Language.

Optional following data can be provided:

• Street and number
• Postal code
• City
• Date of birth.

To analyse the newsletters sent, the following data is collected from you when you read the newsletter and processed further:

• IP address (of the device on which the newsletter is read)
• preferences when reading the newsletter (click behaviour)
• blocking and marking as spam
• Time of opening the newsletter.

If you do not wish to provide this information, please do not subscribe to the newsletter. You can unsubscribe from the newsletter at any time.

2.15 Collected Data: Requests and Contact

If you send us any requests (e.g. by contact form, email) the contact details that you provide there, will be stored by us for the purpose of processing the request and if any follow-up questions should arise.

This data is processed on the basis of Art 6 para 1 lit b GDPR, to the extent that your request is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art 6 para 1 lit f GDPR) or on your consent (Art 6 para 1 lit a GDPR), provided that this was requested. We will not pass on this data without your consent.

The App extends this data with additional information in the service ticket to better help with the request:

• App version
• Language
• Motorcycle
• Optional: attachments added by the user
• Usage logs
• User questions, requests or messages
• Email address
• Phone model.

As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests responding to your requests. Your interest in confidentiality recedes. Otherwise, we would not be able to respond to your requests.

2.16 Collected Data: Bike

We process data related to your bike in order to provide general services (e.g. maintenance, software/firmware updates, recalls, product and service improvements).

The following data will be collected, stored, analysed or otherwise processed as described below:

Profile Information

• Name / Surname (not mandatory)
• E-Mail address (not mandatory)
• Phone number (mandatory)
• IP address (mandatory)
• Respective dealer (mandatory)

Bike Information

• Plate (not mandatory)
• VIN number or date of delivery of the motorcycle or date of the last service (in case the VIN cannot be found in the VIN Database and the motorcycle is not older than 14 days) (mandatory)
• Type (mandatory)
• Model (mandatory)
• Software / firmware version (mandatory)
• Progress details (e.g. update successful, update paused etc.; mandatory)
• Any information in case of an unsuccessful update (mandatory).

We process mandatory data for the fulfilment of our contractual obligations (Art 6 para 1 lit b GDPR), namely the the fulfilment of the respective sales contract and as necessary for the respective service specifically requested by you. Not providing your data would have the consequence that we would not be able to fulfil our contractual obligations. We process the not mandatory data based on your consent (Art 6 para 1 lit a GDPR). Please see the information above on how to activate and deactivate the collection of non-mandatory data.

In addition, we further process your data listed above for the purpose of legitimate interests of our company or on the basis of legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:

• for improving our product and services and
• for providing maintenance support and offers.

As part of the required balancing of interests, we have weighed up your interest in confidentiality against our interests in providing the Digital Property. Your interest in confidentiality recedes. Otherwise, we would not be able to provide you with the Digital Property.

In addition, we further process your data listed above for the purpose of complying with legal obligations (Art 6 para 1 lit c GDPR), namely:

• to monitor product and services and
• to handle recalls.

You may have the following rights in relation to your Personal Data, subject to applicable law and in certain circumstances. Please refer to section 9 if you are based in California or Australia.

7.1 Revocation of your consent to data processing

Certain data processing operations are only possible with your explicit consent. You can revoke consent you have already given at any time. To do this, an informal notification to us by e-mail or via post is sufficient (see contact details below). The legality of the data processing that took place up until the revocation remains unaffected by the revocation.

7.2 Right to object to data processing in specific cases and to direct advertising

You have the right, on grounds relating to your particular situation, to object at any time to processing of your data that is necessary to protect our legitimate interests or those of a third party. In the event of an objection, we will no longer process your data unless the processing serves the assertion, exercise or defence of legal claims or we can demonstrate compelling legitimate grounds for the processing which override your interests. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes (Art 21 GDPR).

7.3 Right to file a complaint with the competent supervisory authority

You have the right to lodge a complaint with the competent data protection authority.

7.4 Information, erasure and rectification

In accordance with Art 15 GDPR, you have the right to request information which personal data is processed by us free of charge at any time. The right of access also includes the right to obtain a copy of the data, provided that this does not adversely affect the rights and freedoms of other persons (Art 15 GDPR).

Furthermore, you have the right to request the correction or completion of incorrect or incomplete data (Art 16 GDPR).

In addition, you can request the deletion of your data at any time (Art 17 DSGVO). Please note that we cannot comply with an erasure request if the processing (storage) is necessary for the fulfilment of a legal obligation (e.g. legal retention obligations) or if we are entitled to do so due to overriding interests (e.g. assertion or defense of certain legal claims).

7.5 Right to data portability

Additionally, you have the right to receive the processed data in a structured, common and machine-readable format. The right to data portability only exists if the data processing is based on your consent or on a contract (Art 20 GDPR).

7.6 Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do this, you can contact us at any time at the address specified in point 5. The right to restriction of processing exists in the following cases:

• If you contest the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the verification process, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data is/has been unlawful, you may request that we restrict the processing instead of erasing the data.
• If we no longer need your personal data, but you do need it to exercise, defend or establish legal claims, you have the right to request the restriction of the processing of your personal data instead of erasing it.
• If you have lodged an objection under Art 21 para 1 GDPR, your interests must be weighed up against our interests. Until it has been established whose interests are overriding, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may, except for storage, only be processed with your consent or for the purpose of establishing, exercising or defending legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

8. Contact

If you have any questions that are not answered by this Privacy Policy, or if you require more detailed information on a particular point, please feel free to contact us. You can find the contact data in the imprint section of the respective Digital Property, or, as otherwise provided by the provider of the website, as indicated in the Digital Property.

9. Specific data protection regulations for certain countries

This App including its additional features is used in various countries. We would therefore like to draw your attention to the specific data protection regulations in the respective countries.