APPLICABILITY OF THIS PRIVACY POLICY

This Privacy Policy applies to RideNow’s online tools and platform (collectively, the “Services”), RideNow.com, and other RideNow websites (collectively, the “Websites”) and other interactions you may have with RideNow. If you disagree with this Privacy Policy, do not access,or use the Services, Websites, or any other aspect of RideNow’s business. To avoid doubt, this is the only privacy policy that applies to RideNow.

This Privacy Policy does not apply to any third-party applications or software that integrate with the Services through the RideNow platform (“Third-Party Services”) or any other third-party products, services, or businesses that will provide their services under their terms of service and privacy policy. In addition, a separate agreement governs delivery, access, and use of the Services (the “Customer Agreement”), including the processing of data such as messages, files, or other content submitted through Services accounts (collectively, “Customer Data”).

California Notice of Collection of Personal Information: We collect the information described below under “Information We Collect and Receive” for the business and commercial purposes described below under “Information Use.” Please review the “California Privacy Rights” section below to learn more about exercising your California Privacy Rights.

INFORMATION WE COLLECT AND RECEIVE

RideNow will collect and receive information through operating the Services and Websites and other interactions with RideNow. Such information will include Customer Data and other information and data (“Other Information”) in a variety of ways:

• 1. CUSTOMER DATA

  When using the Services, customers routinely submit Privileged or Sensitive Data (such as messages, documents, files, or other content) to RideNow.

• 2. OTHER INFORMATION

  RideNow also collects, generates, and receives the following categories of Other Information:

• Account Creation

  To create an account, you supply RideNow with a first name, last name, email address, phone number, and zip code. In addition, Customers that purchase a sports vehicle provide RideNow (or its payment processors) with billing details such as credit card information, banking information, and a billing address.

• Services Metadata

  When an Authorized User interacts with the Services, metadata provides additional context about how an Authorized User uses the Services. For example, RideNow logs the features, content, and links you view or interact with, the types of files shared, and what Third-Party Services are used (if any).

• Log data

  Like most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our Websites or Services and record it in log files. This log data may include your Internet Protocol (IP) address, the address of the web page you visited before using the Website or Services, browser type, settings, the date and time the Services were used, information about browser configuration and plugins, and your language preferences.

• Device information

  RideNow collects information about devices accessing the Services, including the type of device, what operating system is used, device settings, application IDs, unique device identifiers, and crash data. Whether we collect some or all of this other information often depends on the type of device used and its settings.

• Location information

  We receive information from you, our Customers, and other third parties that help us approximate your location. We may, for example, use an address or an IP address received from your browser or device to determine an approximate location to assist with localization or for security purposes.

• Cookie information

  RideNow uses various cookies and similar technologies in our Websites and Services to help us collect Other Information. For more details about how we use these technologies and your opt-out controls and other options, please visit our Cookie Policy.

• Third-Party Services information

  A Customer can choose to permit or restrict Third-Party Services RideNow can receive personal data from such Third-Party Services. RideNow may develop and offer RideNow applications that connect the Services with a Third-Party Service. Once enabled, the provider of a Third-Party Service may share certain information with RideNow. Authorized Users should check the privacy settings and notices in these Third-Party Services to understand what data may be disclosed to RideNow. When a Third-Party Service is enabled, RideNow is authorized to connect and access Other Information made available to RideNow in accordance with our agreement with the provider of Third-Party Services and any permission(s) granted by our Customer (including by its Authorized User(s)). Examples of information that RideNow may receive in this manner include whether you successfully created a new account or interacted with a third-party application in a way that is attributable to RideNow usage activity. We do not, however, receive or store passwords for any of these Third-Party Services when connecting them to the Services.

• Third-Party data

  RideNow may receive data about organizations, industries, lists of companies that are customers, Website visitors, marketing campaigns, and other matters related to our business from other corporation(s), affiliates and subsidiaries, our partners, or others that we use to make our information better or more useful. This data may be combined with Other Information we collect, including aggregate-level data, such as which IP addresses correspond to zip codes or countries. Or it might be more specific: for example, how well an online marketing or email campaign performed.

• Audio and video metadata

  RideNow may receive, capture, and store metadata derived from your use of features such as RideNow photo verification and related data, such as data regarding the date and time of your RideNow visit.

• Additional information provided to RideNow

  We also receive Other Information when submitted to our websites or in other ways, such as responses or opinions you provide if you participate in an activity or event, the feedback you provide about our products or services, the information you provide if you apply for a job with RideNow, request support, interact with our social media accounts or otherwise communicate with RideNow.

  Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information (collectively, “Information”). However, certain Information is collected automatically, and if some Information, such as account setup details, is not provided, we may be unable to provide the Services.

PROCESSING YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO

RideNow will use Customer Data in accordance with a Customer’s instructions, including to provide the Services, any applicable terms in the Customer Agreement, a Customer’s use of Services functionality, and as required by applicable law. RideNow is a processor of Customer Data, and the Customer is the controller. Customers may, for example, use the Services to access, modify, export, share, and remove their Customer Data and otherwise apply its policies to the Services.

RideNow uses Other Information to operate our Services, Websites, and business. More specifically, RideNow uses Other Information for the following purposes:

• COMPLIANCE WITH A LEGAL OBLIGATION

  RideNow processes Other Information when we comply with a legal obligation, including, for example, to access, preserve or disclose certain information if there is a valid legal request from a regulator, law enforcement, or others. For example, a search warrant or production order from law enforcement to provide information in relation to an investigation, such as your IP address.

  We use account information, Usage information, Cookie information, Third-Party Services Information, Contact information, Third-Party data, Audio and video metadata, and Additional information provided to RideNow for compliance with a legal obligation.

• LEGITIMATE INTERESTS

  We rely on our legitimate interests or the legitimate interests of a third party, which are not outweighed by your interests or fundamental rights and freedoms (“legitimate interests”).

  We use account information, usage information, cookie information, third-party services information, contact information, third-party data, audio and video metadata, and additional information provided to RideNow for the following legitimate interests:

• TO PROVIDE, UPDATE, MAINTAIN, AND PROTECT OUR SERVICES, WEBSITES, AND BUSINESS.

  This includes using Other Information to support the delivery of the Services under a Customer Agreement, prevent or address service errors, security or technical issues, analyze and monitor usage, trends,and other activities, or at an Authorized User’s request.

  It is in our and your interests to provide, update, maintain, and protect our Services, Websites, and business.

• DEVELOPMENT, SEARCH, AND PRODUCTIVITY

  To develop and provide search, learning, and productivity tools and additional features. RideNow tries to make the Services as useful as possible for Authorized Users. For example, we may:

• improve search functionality by using Other Information to help determine and rank the relevance of content, channels, or expertise to an Authorized User;
• make Services or Third-Party Service suggestions based on historical use and predictive models;
• identify organizational trends and insights;
• customize a Services experience; or
• create new productivity features and products.
• It is in our interest and the interest of Customers and Authorized Users to improve and develop the customer support we provide continuously.

TO INVESTIGATE AND HELP PREVENT SECURITY ISSUES AND ABUSE.

We may use various tools, such as device fingerprinting, to prevent issues and abuse. We may process, including in an automated fashion, Other Information to better understand how RideNow is used or to prevent spam or abuse.

It is in our interest to keep the Service secure, detect, prevent, and address abuse (such as spam), and investigate and act regarding suspicious activity on the Services.

TO AGGREGATE OR DE-IDENTIFY INFORMATION.

In some cases, we aggregate or de-identify information we have associated with you and use the resulting information, for example, to improve the Services.

• It is in our interest to research and improves the Services;
• It is in the interests of Customers and Authorized Users to practice data minimization and privacy by design regarding their information.

SHARE INFORMATION WITH OTHERS, INCLUDING LAW ENFORCEMENT, AND RESPOND TO LEGAL REQUESTS.

It is in our interest and the interest of the public to prevent and address fraud, unauthorized use of RideNow, violations of our terms, or other harmful or illegal activity; to protect ourselves, our users, or others, including as part of investigations or regulatory inquiries; or to prevent death or imminent bodily harm.

We use account information, Third-Party Services Information, Third-Party data, and Additional information provided to RideNow for the following legitimate interests:

1. Communicate with you by responding to your requests, comments, and questions.

If you contact us, we may use your Other Information to respond.

• It is in our, our Customers’, and Authorized Users’ interests to facilitate communication (for example, to answer customer questions).

2. To send service emails and other communications.

For example, we may:

• send you service, technical, and other administrative emails, messages, and other communications; or
• contact you to inform you about changes in our Services, our Services offerings, and important Services-related notices, such as security and fraud notices. These communications are considered part of the Services, and you may not opt out of them. It is in our Customers and Authorized Users’ interests to address service-related issues.

We use account information and Usage information for the following legitimate interests:

3. For billing, account management, and other administrative matters.

RideNow may need to contact you for account management and similar reasons, and we use account data to administer accounts.

• It is in our interest to facilitate the effective provision and administration of the Websites and Services.

We use account information, Usage Information, Cookie information, Third-Party Services Information, Third-Party data, and Additional information provided to RideNow for the following legitimate interests:

4. To send marketing emails and other communications.

We sometimes send emails about new product features, promotional communications, or other news about RideNow. These are marketing messages, so you can control whether you receive them. If you have additional questions about a notice you have received from RideNow, please get in touch through the contact mechanisms described below.

• It is in our interest to promote the Websites and Services and send our direct marketing.

HOW WE SHARE AND DISCLOSE INFORMATION

This section describes how RideNow may share and disclose Information, as described in the section entitled 'Information We Collect and Receive' above. Customers determine their policies and practices for the sharing and disclosure of Information to third parties. RideNow does not control how a Customer or any third-party shares or discloses information.

THIRD-PARTY SERVICE PROVIDERS AND PARTNERS

We may engage third-party companies or individuals as service providers or business partners to process Information and support our business. These third parties may, for example, assist RideNow with verifying Ownership and Customers, or we may share business information to develop strategic partnerships with Third-Party service providers to support our common customers. In this respect, depending on the Third-Party service provided, RideNow may share your Information.

THIRD-PARTY SERVICES

A Customer may enable Third-Party Services. We require each Third-Party Service provider to disclose all permissions for information accessible through the Services, but we do not guarantee that they do so. When a Customer enables Third-Party Services, RideNow may share Information with Third-Party Services. Third-Party Services are not owned or controlled by RideNow, and third parties that have been granted access to Information may have their own policies and practices for its collection, use, and sharing. Please check the permissions, privacy settings, and notices for these Third-Party Services or contact the provider for any questions.

• Forums. The information you choose to provide in a community forum, including personal data, will be publicly available.
• Organizers and sponsors of Events. If you attend an event organized by RideNow, we may share your profile and information with the event or webinar sponsors when you register or scan your badge. If applicable law requires, you may consent to such sharing via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. Your information will be subject to the sponsors’ privacy statements. For more information, please refer to the terms when registering for an event or webinar.
• Professional advisers. We may share your Information with professional advisers, including lawyers, bankers, auditors, and insurers who provide consultancy, financing, and accounting services. To the extent,we are legally obliged to share or have a legitimate interest in sharing your Information containing personal data.
• Corporate Affiliates. RideNow may share Information with our corporate affiliates, parents, and subsidiaries.
• During a Change to RideNow’s Business. If RideNow engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of RideNow’s assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, some or all of the Information described in the ‘Information We Collect and Receive,’ section may be shared or transferred, subject to standard confidentiality arrangements.
• Aggregated or De-identified Data. We may disclose or use aggregated or de-identified Information for any purpose. For example, we may share aggregated or de-identified Information with prospects or partners for business or research.
• Law Enforcement and Regulators. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation, or legal process.
• To enforce our rights, prevent fraud, and for safety. To protect and defend the rights, property, or safety of RideNow, its users, or third parties, including enforcing its contracts or policies, or in connection with investigating and preventing illegal activity, fraud, or security issues, including preventing death or imminent bodily harm.
• With Consent. RideNow may share Information with third parties when we have consent to do so or as otherwise permitted in this Privacy Policy.

DATA RETENTION

RideNow will retain Customer Data in accordance with any applicable terms in the Customer Agreement and through the Customer’s use of Services and as required by applicable law.

RideNow may retain Other Information about you for as long as necessary for the purposes described in this Privacy Policy (such as to provide the Services, including any optional features you use, and to provide customer support). This may include keeping your Other Information after deactivating your account for the period needed for RideNow to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes, and enforce our agreements.

SECURITY

RideNow takes the security of data very seriously. RideNow works hard to protect the Information you provide from loss, misuse, and unauthorized access or disclosure. These steps consider the sensitivity of the Information we collect, process, and store and the current state of technology. To learn more about current practices and policies regarding the security and confidentiality of the Services, please visit our Security Practices. Given the nature of communications and information processing technology, RideNow cannot guarantee that Information during transmission through the Internet will be safe from intrusion by others. When you click a link to a third-party site, you will leave our site, and we don’t control or endorse what is on third-party sites.

AGE LIMITATIONS

RideNow does not allow the use of our Services and Websites by anyone younger than 17 years old to the extent prohibited by applicable law. If you learn that anyone younger than 17 has unlawfully provided us with personal data, please get in touch with us, and we will take steps to delete such information.

CHANGES TO THIS PRIVACY POLICY

RideNow may change this Privacy Policy from time to time. Laws, regulations, and industry standards evolve, making those changes necessary, or we may change our services or business. We will post the changes to this page and encourage you to review our Privacy Policy to stay informed. If you disagree with the changes to this Privacy Policy, you should deactivate your Services account. Contact the Customer if you wish to request the removal of Personal Data under their control.

DATA PROTECTION OFFICER

To communicate with our Data Protection Officer, please email DPO@RideNow.com.

IDENTIFYING THE DATA CONTROLLER AND PROCESSOR

Data protection law in certain jurisdictions differentiates between the “controller” and “processor” of information. In general, the Customer is the controller of Customer Data. In general, RideNow is the Customer Data processor and the Other Information controller.

Individuals in the United States have certain statutory rights about their personal data. Subject to any exemptions provided by law, you may have the right to request access to your personal information and seek to update, delete, or correct this information. You can do this using the tool provided here.

To the extent that RideNow’s processing of your Personal Data is subject to the CCPA or other applicable laws requiring a legal basis for processing Personal Data, RideNow primarily relies on its legitimate interests, described above, to process your Personal Data. Where we rely on legitimate interests to process your Personal Data, you can object to that processing by contacting us as described in the “Contacting RideNow” section below. In response to your objection, we will stop processing your information for the relevant purposes unless we have compelling grounds, or the processing is necessary in the context of legal claims. RideNow may also process Other Information that constitutes your Personal Data for direct marketing. You have a right to object to RideNow’s use of your Personal Data for this purpose at any time.

YOUR CALIFORNIA PRIVACY RIGHTS

This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA,” as amended by the California Privacy Rights Act or “CPRA.”

California law requires that we detail the categories of personal information that we collect and disclose for specific “business purposes,” such as to service providers that assist us with securing our services or marketing our products and to such other entities as described in earlier sections of the Privacy Policy. In addition to the information provided above in the ‘Information We Collect and Receive’ section, we collect the following categories of personal information from you, your employer, data analytics providers, data brokers, and Third-Party Services for our business purposes:

• Identifiers/contact information;
• Commercial information;
• Internet or electronic network activity information;
• Financial information;
• Geolocation information;
• Professional or employment-related information;
• Audio and visual data;
• In limited circumstances where allowed by law, information that may be protected under California or United States law; and
• Inferences drawn from any of the above categories.

We collect this information for the business and commercial purposes described in the ‘How We Process your Information and our Legal Bases for Doing So’ section above. We share this information as described in the ‘How We Share and Disclose Information’ section above. RideNow does not sell (or as defined in the CCPA or otherwise) the personal information we collect (and will not sell it without providing a right to opt-out). We may also share personal information (in the form of identifiers and internet activity information) with third party advertisers to target advertisements on non-RideNow websites, applications, and services. In addition, we may allow third parties to collect personal information from our sites or services if those third parties are authorized service providers who have agreed to our contractual limitations as to their retention, use, and disclosure of such personal information or if you use our sites or services to interact with third-parties or direct us to disclose your personal information to third parties.

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use, disclose, or may sell this information), to delete their personal information, to opt out of any “sales,” to know and opt out of sharing of personal information for delivering advertisements on non-RideNow websites, and not to be discriminated against for exercising these rights.

California consumers may make a request pursuant to their rights under the CCPA by contacting us at Privacy@RideNow.com or by filling out this form. We will verify your request using the information associated with your account, including your email address. Government identification may be required. Consumers can also designate an authorized agent to exercise these rights on their behalf. Authorized agents must submit proof of authorization.

CONTACTING RIDENOW

Please also feel free to contact RideNow if you have any questions about this Privacy Policy or RideNow’s practices or seek to exercise any of your statutory rights. RideNow will respond within a reasonable timeframe. You may contact us at Privacy@RideNow.com or our mailing address below:

RideNow901 W Walnut Hill Lane#110AIrving, TX 75038United States

Last Revision: April 26, 2023

APPLICABILITY OF THIS PRIVACY POLICY

This Privacy Policy applies to RumbleOn’s online tools and platform (collectively, the “Services”), RumbleOn.com, and other RumbleOn websites (collectively, the “Websites”) and other interactions you may have with RumbleOn. If you disagree with this Privacy Policy, do not access, or use the Services, Websites, or any other aspect of RumbleOn’s business. To avoid doubt, this is the only privacy policy that applies to RumbleOn.

This Privacy Policy does not apply to any third-party applications or software that integrate with the Services through the RumbleOn platform (“Third-Party Services”) or any other third-party products, services, or businesses that will provide their services under their terms of service and privacy policy. In addition, a separate agreement governs delivery, access, and use of the Services (the “Customer Agreement”), including the processing of data such as messages, files, or other content submitted through Services accounts (collectively, “Customer Data”).

California Notice of Collection of Personal Information: We collect the information described below under “Information We Collect and Receive” for the business and commercial purposes described below under “Information Use.” Please review the “California Privacy Rights” section below to learn more about exercising your California Privacy Rights.

INFORMATION WE COLLECT AND RECEIVE

RumbleOn will collect and receive information through operating the Services and Websites and other interactions with RumbleOn. Such information will include Customer Data and other information and data (“Other Information”) in a variety of ways:

• 1. CUSTOMER DATA

  When using the Services, customers routinely submit Privileged or Sensitive Data (such as messages, documents, files, or other content) to RumbleOn.

• 2. OTHER INFORMATION

  RumbleOn also collects, generates, and receives the following categories of Other Information:

• Account Creation

  To create an account, you supply RumbleOn with a first name, last name, email address, phone number, and zip code. In addition, Customers that purchase a sports vehicle provide RumbleOn (or its payment processors) with billing details such as credit card information, banking information, and a billing address.

• Services Metadata

  When an Authorized User interacts with the Services, metadata provides additional context about how an Authorized User uses the Services. For example, RumbleOn logs the features, content, and links you view or interact with, the types of files shared, and what Third-Party Services are used (if any).

• Log data

  Like most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our Websites or Services and record it in log files. This log data may include your Internet Protocol (IP) address, the address of the web page you visited before using the Website or Services, browser type, settings, the date and time the Services were used, information about browser configuration and plugins, and your language preferences.

• Device information

  RumbleOn collects information about devices accessing the Services, including the type of device, what operating system is used, device settings, application IDs, unique device identifiers, and crash data. Whether we collect some or all of this other information often depends on the type of device used and its settings.

• Location information

  We receive information from you, our Customers, and other third parties that help us approximate your location. We may, for example, use an address or an IP address received from your browser or device to determine an approximate location to assist with localization or for security purposes.

• Cookie information

  RumbleOn uses various cookies and similar technologies in our Websites and Services to help us collect Other Information. For more details about how we use these technologies and your opt-out controls and other options, please visit our Cookie Policy.

• Third-Party Services information

  A Customer can choose to permit or restrict Third-Party Services RumbleOn can receive personal data from such Third-Party Services. RumbleOn may develop and offer RumbleOn applications that connect the Services with a Third-Party Service. Once enabled, the provider of a Third-Party Service may share certain information with RumbleOn. Authorized Users should check the privacy settings and notices in these Third-Party Services to understand what data may be disclosed to RumbleOn. When a Third-Party Service is enabled, RumbleOn is authorized to connect and access Other Information made available to RumbleOn in accordance with our agreement with the provider of Third-Party Services and any permission(s) granted by our Customer (including by its Authorized User(s)). Examples of information that RumbleOn may receive in this manner include whether you successfully created a new account or interacted with a third-party application in a way that is attributable to RumbleOn usage activity. We do not, however, receive or store passwords for any of these Third-Party Services when connecting them to the Services.

• Third-Party data

  RumbleOn may receive data about organizations, industries, lists of companies that are customers, Website visitors, marketing campaigns, and other matters related to our business from other corporation(s), affiliates and subsidiaries, our partners, or others that we use to make our information better or more useful. This data may be combined with Other Information we collect, including aggregate-level data, such as which IP addresses correspond to zip codes or countries. Or it might be more specific: for example, how well an online marketing or email campaign performed.

• Audio and video metadata

  RumbleOn may receive, capture, and store metadata derived from your use of features such as RumbleOn photo verification and related data, such as data regarding the date and time of your RumbleOn visit.

• Additional information provided to RumbleOn

  We also receive Other Information when submitted to our websites or in other ways, such as responses or opinions you provide if you participate in an activity or event, the feedback you provide about our products or services, the information you provide if you apply for a job with RumbleOn, request support, interact with our social media accounts or otherwise communicate with RumbleOn.

  Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information (collectively, “Information”). However, certain Information is collected automatically, and if some Information, such as account setup details, is not provided, we may be unable to provide the Services.

PROCESSING YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO

RumbleOn will use Customer Data in accordance with a Customer’s instructions, including to provide the Services, any applicable terms in the Customer Agreement, a Customer’s use of Services functionality, and as required by applicable law. RumbleOn is a processor of Customer Data, and the Customer is the controller. Customers may, for example, use the Services to access, modify, export, share, and remove their Customer Data and otherwise apply its policies to the Services.

RumbleOn uses Other Information to operate our Services, Websites, and business. More specifically, RumbleOn uses Other Information for the following purposes:

• COMPLIANCE WITH A LEGAL OBLIGATION

  RumbleOn processes Other Information when we comply with a legal obligation, including, for example, to access, preserve or disclose certain information if there is a valid legal request from a regulator, law enforcement, or others. For example, a search warrant or production order from law enforcement to provide information in relation to an investigation, such as your IP address.

  We use account information, Usage information, Cookie information, Third-Party Services Information, Contact information, Third-Party data, Audio and video metadata, and Additional information provided to RumbleOn for compliance with a legal obligation.

• LEGITIMATE INTERESTS

  We rely on our legitimate interests or the legitimate interests of a third party, which are not outweighed by your interests or fundamental rights and freedoms (“legitimate interests”).

  We use account information, usage information, cookie information, third-party services information, contact information, third-party data, audio and video metadata, and additional information provided to RumbleOn for the following legitimate interests:

• TO PROVIDE, UPDATE, MAINTAIN, AND PROTECT OUR SERVICES, WEBSITES, AND BUSINESS.

  This includes using Other Information to support the delivery of the Services under a Customer Agreement, prevent or address service errors, security or technical issues, analyze and monitor usage, trends,and other activities, or at an Authorized User’s request.

  It is in our and your interests to provide, update, maintain, and protect our Services, Websites, and business.

• DEVELOPMENT, SEARCH, AND PRODUCTIVITY

  To develop and provide search, learning, and productivity tools and additional features. RumbleOn tries to make the Services as useful as possible for Authorized Users. For example, we may:

• improve search functionality by using Other Information to help determine and rank the relevance of content, channels, or expertise to an Authorized User;
• make Services or Third-Party Service suggestions based on historical use and predictive models;
• identify organizational trends and insights;
• customize a Services experience; or
• create new productivity features and products.
• It is in our interest and the interest of Customers and Authorized Users to improve and develop the customer support we provide continuously.

TO INVESTIGATE AND HELP PREVENT SECURITY ISSUES AND ABUSE.

We may use various tools, such as device fingerprinting, to prevent issues and abuse. We may process, including in an automated fashion, Other Information to better understand how RumbleOn is used or to prevent spam or abuse.

It is in our interest to keep the Service secure, detect, prevent, and address abuse (such as spam), and investigate and act regarding suspicious activity on the Services.

TO AGGREGATE OR DE-IDENTIFY INFORMATION.

In some cases, we aggregate or de-identify information we have associated with you and use the resulting information, for example, to improve the Services.

• It is in our interest to research and improves the Services;
• It is in the interests of Customers and Authorized Users to practice data minimization and privacy by design regarding their information.

SHARE INFORMATION WITH OTHERS, INCLUDING LAW ENFORCEMENT, AND RESPOND TO LEGAL REQUESTS.

It is in our interest and the interest of the public to prevent and address fraud, unauthorized use of RumbleOn, violations of our terms, or other harmful or illegal activity; to protect ourselves, our users, or others, including as part of investigations or regulatory inquiries; or to prevent death or imminent bodily harm.

We use account information, Third-Party Services Information, Third-Party data, and Additional information provided to RumbleOn for the following legitimate interests:

1. Communicate with you by responding to your requests, comments, and questions.

If you contact us, we may use your Other Information to respond.

• It is in our, our Customers’, and Authorized Users’ interests to facilitate communication (for example, to answer customer questions).

2. To send service emails and other communications.

For example, we may:

• send you service, technical, and other administrative emails, messages, and other communications; or
• contact you to inform you about changes in our Services, our Services offerings, and important Services-related notices, such as security and fraud notices. These communications are considered part of the Services, and you may not opt out of them. It is in our Customers and Authorized Users’ interests to address service-related issues.

We use account information and Usage information for the following legitimate interests:

3. For billing, account management, and other administrative matters.

RumbleOn may need to contact you for account management and similar reasons, and we use account data to administer accounts.

• It is in our interest to facilitate the effective provision and administration of the Websites and Services.

We use account information, Usage Information, Cookie information, Third-Party Services Information, Third-Party data, and Additional information provided to RumbleOn for the following legitimate interests:

4. To send marketing emails and other communications.

We sometimes send emails about new product features, promotional communications, or other news about RumbleOn. These are marketing messages, so you can control whether you receive them. If you have additional questions about a notice you have received from RumbleOn, please get in touch through the contact mechanisms described below.

• It is in our interest to promote the Websites and Services and send our direct marketing.

HOW WE SHARE AND DISCLOSE INFORMATION

This section describes how RumbleOn may share and disclose Information, as described in the section entitled 'Information We Collect and Receive' above. Customers determine their policies and practices for the sharing and disclosure of Information to third parties. RumbleOn does not control how a Customer or any third-party shares or discloses information.

THIRD-PARTY SERVICE PROVIDERS AND PARTNERS

We may engage third-party companies or individuals as service providers or business partners to process Information and support our business. These third parties may, for example, assist RumbleOn with verifying Ownership and Customers, or we may share business information to develop strategic partnerships with Third-Party service providers to support our common customers. In this respect, depending on the Third-Party service provided, RumbleOn may share your Information.

THIRD-PARTY SERVICES

A Customer may enable Third-Party Services. We require each Third-Party Service provider to disclose all permissions for information accessible through the Services, but we do not guarantee that they do so. When a Customer enables Third-Party Services, RumbleOn may share Information with Third-Party Services. Third-Party Services are not owned or controlled by RumbleOn, and third parties that have been granted access to Information may have their own policies and practices for its collection, use, and sharing. Please check the permissions, privacy settings, and notices for these Third-Party Services or contact the provider for any questions.

• Forums. The information you choose to provide in a community forum, including personal data, will be publicly available.
• Organizers and sponsors of Events. If you attend an event organized by RumbleOn, we may share your profile and information with the event or webinar sponsors when you register or scan your badge. If applicable law requires, you may consent to such sharing via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. Your information will be subject to the sponsors’ privacy statements. For more information, please refer to the terms when registering for an event or webinar.
• Professional advisers. We may share your Information with professional advisers, including lawyers, bankers, auditors, and insurers who provide consultancy, financing, and accounting services. To the extent,we are legally obliged to share or have a legitimate interest in sharing your Information containing personal data.
• Corporate Affiliates. RumbleOn may share Information with our corporate affiliates, parents, and subsidiaries.
• During a Change to RumbleOn’s Business. If RumbleOn engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of RumbleOn’s assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, some or all of the Information described in the ‘Information We Collect and Receive,’ section may be shared or transferred, subject to standard confidentiality arrangements.
• Aggregated or De-identified Data. We may disclose or use aggregated or de-identified Information for any purpose. For example, we may share aggregated or de-identified Information with prospects or partners for business or research.
• Law Enforcement and Regulators. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation, or legal process.
• To enforce our rights, prevent fraud, and for safety. To protect and defend the rights, property, or safety of RumbleOn, its users, or third parties, including enforcing its contracts or policies, or in connection with investigating and preventing illegal activity, fraud, or security issues, including preventing death or imminent bodily harm.
• With Consent. RumbleOn may share Information with third parties when we have consent to do so or as otherwise permitted in this Privacy Policy.

DATA RETENTION

RumbleOn will retain Customer Data in accordance with any applicable terms in the Customer Agreement and through the Customer’s use of Services and as required by applicable law.

RumbleOn may retain Other Information about you for as long as necessary for the purposes described in this Privacy Policy (such as to provide the Services, including any optional features you use, and to provide customer support). This may include keeping your Other Information after deactivating your account for the period needed for RumbleOn to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes, and enforce our agreements.

SECURITY

RumbleOn takes the security of data very seriously. RumbleOn works hard to protect the Information you provide from loss, misuse, and unauthorized access or disclosure. These steps consider the sensitivity of the Information we collect, process, and store and the current state of technology. To learn more about current practices and policies regarding the security and confidentiality of the Services, please visit our Security Practices. Given the nature of communications and information processing technology, RumbleOn cannot guarantee that Information during transmission through the Internet will be safe from intrusion by others. When you click a link to a third-party site, you will leave our site, and we don’t control or endorse what is on third-party sites.

AGE LIMITATIONS

RumbleOn does not allow the use of our Services and Websites by anyone younger than 17 years old to the extent prohibited by applicable law. If you learn that anyone younger than 17 has unlawfully provided us with personal data, please get in touch with us, and we will take steps to delete such information.

CHANGES TO THIS PRIVACY POLICY

RumbleOn may change this Privacy Policy from time to time. Laws, regulations, and industry standards evolve, making those changes necessary, or we may change our services or business. We will post the changes to this page and encourage you to review our Privacy Policy to stay informed. If you disagree with the changes to this Privacy Policy, you should deactivate your Services account. Contact the Customer if you wish to request the removal of Personal Data under their control.

DATA PROTECTION OFFICER

To communicate with our Data Protection Officer, please email DPO@RumbleOn.com.

IDENTIFYING THE DATA CONTROLLER AND PROCESSOR

Data protection law in certain jurisdictions differentiates between the “controller” and “processor” of information. In general, the Customer is the controller of Customer Data. In general, RumbleOn is the Customer Data processor and the Other Information controller.

Individuals in the United States have certain statutory rights about their personal data. Subject to any exemptions provided by law, you may have the right to request access to your personal information and seek to update, delete, or correct this information. You can do this using the tool provided here.

To the extent that RumbleOn’s processing of your Personal Data is subject to the CCPA or other applicable laws requiring a legal basis for processing Personal Data, RumbleOn primarily relies on its legitimate interests, described above, to process your Personal Data. Where we rely on legitimate interests to process your Personal Data, you can object to that processing by contacting us as described in the “Contacting RumbleOn” section below. In response to your objection, we will stop processing your information for the relevant purposes unless we have compelling grounds, or the processing is necessary in the context of legal claims. RumbleOn may also process Other Information that constitutes your Personal Data for direct marketing. You have a right to object to RumbleOn’s use of your Personal Data for this purpose at any time.

YOUR CALIFORNIA PRIVACY RIGHTS

This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA,” as amended by the California Privacy Rights Act or “CPRA.”

California law requires that we detail the categories of personal information that we collect and disclose for specific “business purposes,” such as to service providers that assist us with securing our services or marketing our products and to such other entities as described in earlier sections of the Privacy Policy. In addition to the information provided above in the ‘Information We Collect and Receive’ section, we collect the following categories of personal information from you, your employer, data analytics providers, data brokers, and Third-Party Services for our business purposes:

• Identifiers/contact information;
• Commercial information;
• Internet or electronic network activity information;
• Financial information;
• Geolocation information;
• Professional or employment-related information;
• Audio and visual data;
• In limited circumstances where allowed by law, information that may be protected under California or United States law; and
• Inferences drawn from any of the above categories.

We collect this information for the business and commercial purposes described in the ‘How We Process your Information and our Legal Bases for Doing So’ section above. We share this information as described in the ‘How We Share and Disclose Information’ section above. RumbleOn does not sell (or as defined in the CCPA or otherwise) the personal information we collect (and will not sell it without providing a right to opt-out). We may also share personal information (in the form of identifiers and internet activity information) with third party advertisers to target advertisements on non-RumbleOn websites, applications, and services. In addition, we may allow third parties to collect personal information from our sites or services if those third parties are authorized service providers who have agreed to our contractual limitations as to their retention, use, and disclosure of such personal information or if you use our sites or services to interact with third-parties or direct us to disclose your personal information to third parties.

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use, disclose, or may sell this information), to delete their personal information, to opt out of any “sales,” to know and opt out of sharing of personal information for delivering advertisements on non-RumbleOn websites, and not to be discriminated against for exercising these rights.

California consumers may make a request pursuant to their rights under the CCPA by contacting us at Privacy@RumbleOn.com or by filling out this form. We will verify your request using the information associated with your account, including your email address. Government identification may be required. Consumers can also designate an authorized agent to exercise these rights on their behalf. Authorized agents must submit proof of authorization.

CONTACTING RUMBLEON

Please also feel free to contact RumbleOn if you have any questions about this Privacy Policy or RumbleOn’s practices or seek to exercise any of your statutory rights. RumbleOn will respond within a reasonable timeframe. You may contact us at Privacy@RumbleOn.com or our mailing address below:

RumbleOn901 W Walnut Hill Lane#110AIrving, TX 75038United States

Last Revision: April 26, 2023

California Transparency in Supply Chains Act

On January 1, 2012, the California Transparency in Supply Chains Act of 2010 (the “Act”) went into effect in the State of California. Under the law, large manufacturers and retailers are required to disclose their efforts to eradicate slavery and human trafficking within their supply chains. The law’s underlying purpose is to educate consumers, so they can make informed decisions and purchase goods from companies that responsibly manage their supply chains.

RumbleOn and its RideNow powersports dealerships (hereafter “RumbleOn”) do not support or condone human trafficking or slavery. RumbleOn believes that its manufacturer partners are in the best position to audit their respective supply chains to address this important issue. Therefore, as a franchised dealer of multiple vehicle manufacturers, we rely on the efforts of our franchisor partners, many of whom are headquartered in California, with respect to the supply chain for all vehicles and parts sold in California.

RumbleOn sources the majority of its products from established national and international vendors with which RumbleOn has had long-standing relationships and known business practices. Accordingly, RumbleOn does not independently verify or audit its manufacturers’ supply chain, require its manufacturers to certify that parts and materials comply with slavery or human trafficking laws, maintain internal accountability standards for, or provide employee training on, the prevention of human trafficking.

The Act’s specific disclosure requirements and RumbleOn’s responses are set forth below regarding whether, and to what extent, RumbleOn undertakes the following:

1. Engages in verification of product supply chains to evaluate and address risks of human trafficking and slavery, and whether the verification was conducted by a third party;

At present, RumbleOn does not verify product supply chains to evaluate and address risks of human trafficking and slavery. We rely on the large manufacturers’ controls and efforts to combat slavery and human trafficking in building and delivering their products to our dealerships.

2. Conducts audits of suppliers to evaluate supplier compliance with company standards for trafficking and slavery in supply chains, and whether the audits were independent and unannounced;

RumbleOn does not presently audit its suppliers to evaluate and address risks of human trafficking and slavery.

3. Requires direct suppliers to certify that materials incorporated into the product comply with the laws regarding slavery and human trafficking of the country or countries in which they are doing business;

RumbleOn does not require direct suppliers to certify that products sold directly to RumbleOn dealerships or materials incorporated into its manufactured products comply with the laws regarding slavery and human trafficking of the country or countries in which they are doing business.

4. Maintains internal accountability standards and procedures for employees or contractors failing to meet company standards regarding slavery and trafficking;

RumbleOn does not maintain internal accountability standards and procedures for employees or contractors failing to meet company standards regarding slavery and trafficking.

5. Provides company employees and management, who have direct responsibility for supply chain management, training on human trafficking and slavery, particularly with respect to mitigating risks within the supply chains of products.

RumbleOn does not provide formal training on human trafficking and slavery to its employees and management who have direct responsibility for supply chain management. RumbleOn does, however, provide information regarding the California Transparency in Supply Chains Act to the employee(s) with direct control over sourcing of apparel, parts, and accessories for their review and consideration when selecting vendors / suppliers. RumbleOn is developing a Supplier Code of Conduct and reviewing the viability of periodic supplier surveys and certifications.