Privacy Notice

1. Introduction and Scope

Security of your personal data is important to us, hence, we treat your privacy with respect, fairness and integrity. This Privacy Notice explains how Eicher Motors Limited (“the Company”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal data when you visit or interact with our Digital Platforms, create an account, pre-book, purchase or register a Flying Flea electric vehicle (“EV”), connect to our services, or otherwise interact with us.

Where we refer to "you" or "your" in this Notice, we mean any individual who visits or interacts with our Digital Platforms, books a test ride, purchases or registers a Flying Flea motorcycle, creates a Fleaware OS account, uses the Flying Flea companion app, or otherwise interacts with us or our dealer network.

This Privacy Notice applies to all digital properties, connected vehicle services and related services operated by Eicher Motors Limited globally, including but not limited to:

• Our websites -FF website, FF dealer portals FF booking portal and Associated subdomains;
• Our mobile applications (including the Flying Flea App and any official companion apps); and
• Related digital features, software, and online services

(Collectively referred to in this Privacy Notice as our “Digital Platforms”)

This Privacy Notice is intended to apply globally. Where the applicable data protection laws of the jurisdiction in which you are located impose additional or different requirements, those requirements will apply to the extent applicable.

For the purposes of this Privacy Notice, “Applicable Data Protection Laws” means the data protection, privacy and related laws applicable to the processing of your personal data, based on your location, the services you use and the circumstances of the processing.

EU Data Act Notice:

For individuals located in, or connected motorcycles operating within, the European Union, this notice covers your personal data. Non-personal product and related-service data generated by your connected motorcycle under the EU Data Act are separately addressed in our Flying Flea Data Act Information Notice, available at EU Data Act Information Notice.

2. Personal Data We Collect

We may collect the following categories of personal data, depending on how you interact with our Digital Platforms

2.1 Data shared directly by You

1. Identity and contact data: Name, email address, phone number, postal address, date of birth and government ID proofs where required.
2. Account credentials: Fleaware.OS username, password (hashed), profile pictures, account preferences, feedback, queries.
3. Order and transaction data: Purchase history, financing or EMI application details, dealer of purchase.
4. Financial data: Payment details (processed by our PCI-DSS certified payment providers; we do not store full card details).
5. Technical data: IP address, browser type and version, device identifiers, operating system, referral source.
6. Test ride & booking data: Test ride bookings, city/location selected, license details where required.
7. Marketing and communications data: Preferences for receiving marketing, survey responses, competition entries.
8. Customer support data: Correspondence, call recordings (where notified), service tickets, warranty claims, complaints, queries.
9. Riders Club data: Membership details, event registrations.

Some Flying Flea features allow you to share information about your motorcycle with people who are not Flying Flea customers or account holders for example, sending a live-tracking link by SMS or email to a friend or family member so they can see your journey in real time. Where you choose to do this:

1. The receipt typically accesses the shared link sent to the phone number or email address you provide;
2. we will process the phone number or email address you provide for the purpose of delivering the link and the one-time passcode, and will retain a record that the link was accessed and when;
3. you confirm that you have the recipient's permission to share their contact details with us for the sole purpose of sending this communication.
4. we process this data on the basis of our legitimate interest in providing the sharing feature you have activated, and, where applicable, your instruction to us to send the link on your behalf.

For Recipients: We process your contact details and link access history based on our legitimate interest in delivering the live-tracking service initiated by the sender. The initial message sent to you will include a direct link to this Privacy Notice detailing how your data is handled and how you can exercise your privacy rights. We do not use recipient contact details for marketing or build profiles on non-registered recipients.

If you are a recipient of a shared link and have questions about how your data is processed in connection with it, you can contact us using the details shared in the “Contract Us” Section. If you call or message someone who has enabled their Bluetooth phone and communication feature, your name, number, or message content may be transiently displayed or read aloud on their vehicle's cluster. This data is not stored by us. Given the nature of incoming calls and messages, it is not possible for us to notify each caller or sender individually; this notice serves as our general disclosure of this processing.

2.2 Connected Vehicle and Telemetry Data (Product Data)

This section covers connected-vehicle data only insofar as it constitutes personal data under applicable Data Protection Laws. When you register, activate, or connect Flying Flea motorcycle, the Digital Platforms (including but not limited to the Fleaware OS operating system, and the companion app), may generate the following categories of product data and related service data, that are considered Personal Data:

1. Account and Pairing Data: Fleaware OS account login, phone-as-key pairing status, Bluetooth/Wi-Fi device pairing.
2. Location data (only when connected services are active and Incognito Mode is off): GPS location, "share my status" location, geofencing boundary alerts, theft/tip-over alert location.
3. Battery and Charging Data: Battery state of charge, charging session data (via onboard charger), wireless phone-charging usage.
4. Vehicle diagnostics: Fault codes, firmware/software version, over-the-air (OTA) update history.
5. Riding behavior data: Ride mode, cruise control use, lean angle/ABS event flags.
6. Connectivity metadata: SIM/eSIM identifiers, app-to-vehicle command logs.
7. Voice and navigation data: Voice Assist interaction data, Google Maps navigation queries and route/charging-stop recommendations.
8. Phone & Communications Data (Bluetooth-paired). When you pair your smartphone with your motorcycle via Bluetooth, we transiently process caller ID (name and number of incoming calls), a rolling log of your last five calls, your favourite contacts, SMS message alerts and read-aloud content, and app notification content, solely to display or read this information through your vehicle's cluster. This data is not stored by us, it is processed only for the duration needed to display or read it aloud, and is discarded immediately afterward.
9. Remote command and access logs: Remote lock/unlock action type, method (LTE or Bluetooth), processing status, and the date, time, and location of each command
10. Digital key sharing data: Status, duration, and revocation history of any digital key ("Digital PIN Share") you grant to another rider to access your motorcycle
11. Vehicle authentication data: Your Vehicle PIN and related reset/renewal events
12. Security and alert data: Tamper, tow, and unauthorised-movement alerts, including the location and time associated with the alert
13. Emergency/SOS data: Data generated when the SOS or emergency alert feature is activated, including location and timing of the alert
14. Ride mode and settings configuration: Saved custom ride mode settings (e.g., power output, torque, regenerative braking level, ABS level) and Vacation Mode status
15. Shared live-tracking data: Where you choose to share a live-tracking link, the link's access history, including that it was opened and when

Incognito Mode: Flying Flea motorcycles let you disable location-based data sharing at any time via Incognito Mode. When enabled, we stop collecting and processing your location, trip details, live tracking, remote access data, and other connected-service data, including features such as geofencing, "share my status," and location-based theft alerts.

2.3 Special Category of Personal Data

We do not intentionally collect special categories of personal data (such as health data) about you except where necessary for the purposes described in this Privacy Notice or as otherwise permitted or required by Applicable Data Protection Laws. However, such data may be processed incidentally in limited circumstances, including where:

1. your motorcycle's crash or emergency detection feature is triggered, and you, an emergency contact, or emergency services provide information about your physical condition as part of the resulting emergency response; or
2. you voluntarily disclose health-related information to us - for example, when making a warranty, insurance, or customer support claim following an accident.

Where we process such data, we do so only to protect your vital interests or those of another person (for example, to facilitate an emergency response), or on another legal basis permitted under applicable law, and only for as long as necessary for that purpose.

2.4 Data From Other Sources

1. Authorized dealers and service centers (service history, ownership transfer records).
2. Payment and financing partners (loan/lease application outcomes).
3. Vehicle registration authorities, insurance verification bodies.
4. Marketing and analytics partners, and social media platforms.
5. Event and campaign partners

2.5 If you fail to provide personal data

Where we are required to collect certain personal data from you in order to provide services through the platform, and you choose not to provide such information, we may not be able to provide you with certain features, services, or functionalities available on the platform.

For example, certain services on the platform may require personal data to enable account creation, vehicle connectivity, navigation features, transaction processing, customer support, or other service-related functionalities. If you choose not to provide the required personal data, the relevant services or functionalities may not be available to you.

3. How we process your Data and Legal Bases for Processing

Where we rely on consent, you can withdraw it at any time, for connected features, this is as simple as turning the feature off in the Fleaware.OS app or enabling Incognito Mode for location-based features. Withdrawing consent doesn't affect the lawfulness of processing carried out before withdrawal.

4. How We Use Your Data

1. To provide, operate, and maintain the Digital Platform, your account, and connected vehicle services.
2. To process orders, deliveries, financing, registration, and after-sales support.
3. To monitor vehicle health, issue safety/firmware updates, and manage recalls.
4. To personalize your riding experience where you opt in (ride modes, route suggestions, range prediction).
5. To display incoming call, message, and notification information from your paired smartphone on your vehicle's cluster, and to read this information aloud where you have enabled this feature, for your convenience and safety while riding.
6. To improve our products through aggregated or pseudonymized analysis of telemetry and usage trends.
7. To communicate service, safety, and recall notices.
8. To send marketing communications where you have consented or as otherwise permitted by local law.
9. To detect, investigate, and prevent fraud, theft, and unauthorized vehicle access.
10. To comply with legal, tax, warranty, and regulatory obligations, including type-approval and roadworthiness reporting.

5. Who We Share Your Data With

1. Group companies including subsidiaries and affiliates of Eicher Motors Limited, for shared platform operation, R&D, and group reporting.
2. Authorized dealers, service centers, distributors network and technicians to fulfil test ride bookings, purchases, warranty, after-sales service and Roadside assistance partners.
3. Payment, financing and insurance partners to process payments, loan/lease applications, and insurance claims.
4. Cloud hosting, telematics, IT service providers and our authorized call center partners.
5. Logistics and courier companies who transport our products to you
6. Marketing and analytics partners, only where you have provided consent.
7. Regulators, law enforcement, and public authorities, where we are legally required to, or to establish, exercise, or defend legal claims.
8. A buyer or successor entity in the event of a merger, acquisition, or restructuring of the Company.

6. International Data Transfers

We are an organization based out of India, hence your personal information may be transferred to, and stored in, India and other countries which may be outside your country of residence, in particular in connection with the operation of our shared Fleaware.OS connected-vehicle platform, backend engineering, and customer support functions. Some of these countries, including India, are not currently the subject of an adequacy decision by the European Commission or the UK Government and may apply different standards of data protection than your country of residence.

We will take appropriate steps to ensure that any transfer of your personal information outside the European Economic Area (EEA) or the United Kingdom is carried out in accordance with applicable law, and we only transfer personal information to another country where:

1. We are satisfied that adequate levels of protection are in place to protect your information; and
2. The transfer is limited to countries which either benefit from an adequacy decision or are covered by alternative safeguards that we are satisfied with providing an adequate level of protection.

To this end:

1. Transfers within the Eicher Motors Group are covered by an intra-group data transfer agreement, incorporating Standard Contractual Clauses, which contractually oblige each group entity to protect your personal information receives an adequate and consistent level of protection wherever it is transferred within the group, together with supplementary technical measures such as encryption in transit and at rest, role-based access controls, and data minimization at the receiving location.
2. Where we transfer your personal information outside the group to third parties who help us provide our products and services, we obtain contractual commitments from them, to protect your personal information to the same standard.
3. Where we receive requests for information from law enforcement, courts, or regulators, we carefully review and validate these requests before any personal information is disclosed.

7. Data Retention

We retain your personal data only for as long as necessary to provide our products and services to you, or as required by applicable law. The retention period applied depends on the nature of the data and the purpose for which it was collected; for instance, account and vehicle data is generally retained for the duration of your relationship with Flying Flea, while certain records may be retained for a longer period to comply with our legal, tax, or warranty-related obligations. Once personal data is no longer required for these purposes, we securely delete or anonymize it.

If you sell or otherwise transfer ownership of your motorcycle, you should notify us so that your account and data can be delinked from the vehicle. To do this, please contact our customer care team or write to us providing details of the vehicle and the change in ownership at:

For India: support.india@flyingflea.com

For EU & UK: support.emea@flyingflea.com

Once we receive your request, we will process the removal of the vehicle from your account and perform the necessary steps on our end to ensure that the new owner cannot view any of your historical data associated with that vehicle, including ride history, diagnostics, and location data.

Please note that we may retain certain data relating to the vehicle and its prior ownership where required to comply with our legal, regulatory, warranty, or safety obligations (for example, in connection with recalls, roadworthiness reporting, or dispute resolution), even after the vehicle has been delinked from your account. Any such retained data will continue to be handled in accordance with this Notice and our data retention practices.

8. Your Data Subject Rights

Depending on where you live, data protection law gives you a number of rights over your personal data. These rights are subject to certain exceptions and conditions under applicable law, and we will inform these to you if they apply to a specific request you make.

1. Right to Access: You have the right to confirm whether we hold personal data about you, and if so, to receive a copy of that data, together with information such as the purposes of processing, the categories of data concerned, and the recipients to whom it has been or will be disclosed.
2. Right to Rectification: You have the right to correct any personal data we hold about you that is inaccurate, and to have incomplete personal data completed.
3. Right to Erasure: You have the right to request deletion of your personal data in certain circumstances, for example, where the data is no longer necessary for the purposes for which it was collected. This right does not apply where we need to retain the data to comply with a legal obligation, or to establish, exercise, or defend legal claims.
4. Right to restriction of processing: You have the right to limit the way we use your personal data in certain circumstances.
5. Right to data portability: Where we process your personal data on the basis of your consent or to perform a contract with you, and the processing is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another organization, where technically feasible.
6. Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as our legal basis. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
7. Right to Grievance Redressal: You have the right to seek redressing of any grievances regarding the processing of your personal data.
8. Right to Nomination (For Indian Users): You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your data rights in accordance with applicable law.
9. Right to withdraw consent: Where we rely on your consent to process your personal data for example, for optional connected features such as location sharing, or for marketing communications you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before your withdrawal.

   For location and connected-service data specifically, you can manage or withdraw your consent through two dedicated settings available in the App, under Vehicle Settings > Vehicle Mode:

   • Privacy Mode — When enabled, your location data is not processed by us.
   • Incognito Mode — When enabled, your motorcycle continues to monitor for a crash using onboard sensors, without this requiring the processing of your location or other personal data. This passive monitoring capability is retained so that, if a crash is detected or the SOS button is pressed, your motorcycle can immediately and automatically exit Incognito Mode and resume standard processing, including location data, so that we and emergency services can locate and assist you.
   • The app will display a countdown showing how long Incognito Mode will remain active, and will notify you shortly before it is due to expire so that you can choose to extend it or turn it off.
10. Right to lodge a complaint: If you believe our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the supervisory authority

You may exercise any of the above rights by contacting us using the details in Section 13. To protect your personal data, we may need to verify your identity before responding to your request and may ask you for additional information for this purpose. We will acknowledge receipt of your request without undue delay and provide a substantive response within one month of receiving it.

Taking into account the complexity and number of requests, this period may be extended by up to two additional months where necessary. If an extension is required, we will inform you of the delay and the reasons for it within one month of receiving your initial request.

To protect your personal data, we may need to verify your identity before fulfilling your request and may ask for additional information for this purpose. Exercising your rights is generally free of charge, though we reserve the right to charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

9. Children's Privacy

Our Digital Platforms are intended solely for use by individuals who are legally permitted to use the relevant service or Vehicle under the applicable laws. We do not permit account creation, vehicle registration, or access to any part of our Digital Platforms by individuals below legally permitted age, nor do we not knowingly collect their personal data.

Access to our Digital Platforms are conditioned on the user confirming, at the point of registration, that they are at least the legally permitted age. Where we become aware that personal data has been collected from an individual below this age threshold, we will take steps to delete that data and deactivate the associated account without undue delay.

10. Data Security

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or alteration, and we review these measures regularly to keep pace with new risks. This includes securing your connected motorcycle, account, and the systems we use to store and process your data.

For your convenience and security, you may choose to unlock the App using your phone's built-in fingerprint or facial recognition feature (where supported by your device) or PIN or pattern. This authentication is carried out entirely by your phone's operating system; your fingerprint or facial data is processed and stored locally on your device, and is never received, accessed, or stored by us. We only receive confirmation that your device has been successfully authenticated by you.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We encourage you to do your part by keeping your account password and phone-as-key credentials confidential.

We also require our dealers and technology partners to protect your data to a similarly high standard. Where we become aware of a personal data breach, we will assess, investigate and respond to the breach in accordance with Applicable Data Protection Laws, including notifying relevant authorities and affected individuals where and to the extent required by law

If you believe your personal data may have been compromised, please contact us immediately.

11. Cookies

We use cookies and similar technologies on our Digital Platforms to keep them secure, remember your preferences, and understand how you use them. Strictly necessary cookies do not require your consent. All while all other cookies, including (analytics, functionality, and marketing cookies), require your consent. You can manage your preferences at any time through our cookie preference center.

For full details of the cookies we use and their duration, see our Cookie Policy at https://www.royalenfield.com/uk/en/legal/cookie-policy/

12. Update to this Notice

We may update this Notice from time to time to reflect changes in our practices, our products, or applicable law. We will post the updated Notice on this page with a revised “Effective Date” and, for material changes, notify you via email or an in-app/website notice.

13. Contact Us

If you have questions about this Privacy Notice or how we handle your personal data or would like to exercise any of your rights, please contact us using the details below, based on your location:

14. Language Preferences (For Users in India)

You may choose to receive this Privacy Notice and relevant privacy-related information in a language listed in the Eighth Schedule to the Constitution of India. In accordance with the DPDPA, this Privacy Notice and consent options are available via our Digital Platforms and account settings in English and all 22 languages listed in the Eighth Schedule to the Constitution of India. You can switch your preferred language at any time in your account/Digital Platforms Settings.

22 Language Options: Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santhali, Sindhi, Tamil, Telugu, and Urdu.

Please mail your request to privacy.india@royalenfield.com