PRIVACY POLICY

Norton is the data controller of any personal data that is collected and processed about you in accordance with this Policy. We are registered with the Information Commissioner’s Office (“ICO”), with registration number ZA877690.

If you have any questions about this Policy, how we use your personal data or you would like to exercise your legal rights, please contact us by any of the following methods:

• By post: FAO Data Security Department, Unit 500 Solar Park, Highlands Road, Solihull, B90 4SH, United Kingdom
• By telephone: +44 121 420 3000
• By email: customer.data@nortonmotorcycles.com

“Personal data” is any information about an individual from which that person can be identified. It does not include information derived from personal data where the identity has been removed, such that a person can no longer be directly or indirectly identified by a recipient of the information (“anonymous data”).

When you visit the Site, use the App, purchase something from us or otherwise interact with us, we may collect, use, store and transfer different types of your personal data, which has been grouped together as set out below:

• Personal Identifier Data, which includes your first name, last name, date of birth, gender, signature and Profile Data.
• Contact Data, which includes your telephone number, contact address and email address.
• Profile Data, which includes your username and password (on the Site and/or the App), profile photo, your communication preferences and copies of communications between us.
• Content Data, which is information that you store or generate in the App, being photos, videos and associated metadata, check-ins, posts and messages.
• Enquiry Data, which includes the detail and nature of any enquiries you have made to us and other information that you provide in connection with it (such as your interests, preferences and test ride details), recordings of calls or conversations that you may have with our customer care team, feedback or any survey responses you have provided to us.
• Technical Data, which includes your IP address, browser type and version, operating systems, network information, unique device identifier, time zone setting, device settings and geo-location data.
• Sales Data, which includes your vehicle details such as the make and model of your vehicle, additional vehicle specifications and VIN number.
• Financial Data, which includes information about your payment details such as your card number, cardholder name, card expiry date and security code.
• Purchase History Data, which includes information about goods and services that you have received in the past, including the details of any warranty cover on your vehicle and its service and maintenance history. We will also store any product or sales issues you may raise with us.
• Usage Data. Where this relates to your use of the Site, this includes information about how you use and interact with the Site, such as the pages you visit, the length of time spent on each page and the time of your visit. Where this relates to your use of the App, this includes the dates and times on which you download, access and update the App, any error or debugging information and the resources you access.
• Marketing Data, which includes your preferences for receiving updates, surveys and other marketing communications from us, consents to receive marketing from us and a history of the marketing communications we have sent to you.

If you express your interest to become a sales partner through the Site, then we will collect the following types of your personal data: Personal Identifier Data (your first and last name), Contact Data (your telephone number, contact address and email address) and Company Data (which includes your company name, company address, years of operation, number of employees, brands you represent and your website).

We may also collect, use and share aggregated anonymous data such as statistical or demographic data for any purpose. For example, we may aggregate your Technical Data or Usage Data to calculate the percentage of Site visitors accessing a specific feature. However, if we combine or connect aggregated anonymous data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Policy.

If you do not provide us with your personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide us with that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to sell you our goods).

Our website is not intended for children, and we would ask users to not provide such personal data to us via the website. If we become aware that we have inadvertently received personal information from a child, we may take steps to delete such information from our records. Please contact us at customer.data@nortonmotorcycles.com if this raises any concerns.

We use different methods to collect data from and about you, including through:

• Your direct interactions with us. You may give us your personal data by filling in forms or corresponding with us by post, phone, email or otherwise. This includes personal data you provide to us when you:
  • apply for, discuss or purchase goods or services from us;
  • create an account on our Site or the App;
  • contact us to discuss visits, vehicle servicing, your warranty or the collection or delivery of your goods;
  • contact us to become a sales partner;
  • give us feedback;
  • fill out a survey; and
  • sign up to our newsletter.
• Information you generate when using the App and the Site. Each time you access and use the App we collect Technical, Profile and Usage Data. Each time you use the Site, we collect Technical, Profile and Usage Data.
• Information we collect through monitoring the use of the App and the Site. Each time you access and use the App or the Site we collect information about that access and use, being Transaction, Content and Usage Data.
• Additional information we otherwise collect through the Site and the App where we have your consent to do so.
• Marketing. We collect and record Marketing Data when we add you to our marketing database, when you request to change your direct marketing preferences, or when you interact with our direct marketing communications.
• Information we receive from third parties. Some personal data may be collected by us from third parties or publicly available sources. These include analytics providers such as Google, Financial Data from payment and delivery service providers including Shopify, and Personal Identifier, Contact Data and Company Data from publicly available sources such as Companies House.

Cookies

We use cookies (small files placed on your device) on the Site and the App to improve your experience and our development of the Site and the App. For detailed information on the cookies we use, the purpose for which we use them and how you can exercise your choices regarding our use of your cookies, see our Cookie Policy.

We collect and use your personal data for different purposes depending on how you interact with us. Data protection law requires us to have a legal basis to process your personal data for each particular purpose. We will only use your personal data when we have a legal basis for doing so. Most commonly, we will rely on one of the following legal bases:

• Where it is necessary to perform the contract we are about to enter into or have entered into with you (Performance of a contract with you).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (Necessary for our legitimate interests).
• Where we need to comply with a legal obligation (Necessary to comply with a legal obligation).
• We may also rely on your consent as a legal basis for processing your personal data (Consent).

Purposes for which we will use your personal data

We have set out below, in a table format, a description of purposes for which we may use your personal data, which of the legal bases we rely on to do so, and the types of personal data processed for each purpose. We have also identified what our legitimate interests are, where appropriate.

In some cases, we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your personal data. Please contact us if you would like more detailed information about how we process your personal data.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is lawful and compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we intend to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. Please note that, in limited circumstances, we may process your personal data without your knowledge or consent where this is required or permitted by law.

Special category data

In general, we will not process special category personal data about you unless it is necessary for performing or exercising obligations or rights in connection with your relationship with us. There may also be other reasons for processing, such as where it is in the public interest to do so. Where we process your special category personal data, we will comply with applicable data protection laws, including obtaining your consent where this is required.

Automated decision making

We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).

Sometimes we might share your data with third parties. We will not share your personal data unnecessarily and will always ensure that all third parties who process your personal data on our behalf have entered into an appropriate written contract with us, are required to process it in accordance with our instructions and have appropriate measures in place to protect it.

The types of organisation we may share your personal data with include:

• our retailers, sales partners, franchise partners and agencies based in the UK or the EU, to enable the management of test ride bookings, quotations and sales, vehicle registration and handovers, provide after-sales support and maintenance, collect customer leads and communicate about vehicle delivery; 
• our parent company TVS Motor Co. Ltd (based in India) and other affiliates and group companies with which we are associated, for any of the purposes set out in our processing table set out above;
• Your Appstore Provider and mobile network operator to allow you to install the App;
• service providers we use for specific purposes, who may be based inside or outside the UK or the EU, including:
  • IT service providers (who may process your data when carrying out maintenance on our IT systems);
  • marketing agencies such as Merkle / Dentsu Group (who may process your data when assisting us with marketing campaigns, digital lead capture, website forms and analytics, processing marketing opt-ins and running customer engagement journeys);
  • social media companies (who may process your data when supporting our targeting activities);
  • debt collection agencies (who may process your data if you fail to pay us for our goods and services and we need to enforce the debt);
  • finance providers such as TVS Credit Services Ltd (based in India) or banks (who may process your data should you enquire about financing options for our goods);
  • warranty providers (who may process your data should you purchase goods from us and some or all of the goods are covered under a warranty provided by a third party, in order for them to be able to provide the warranty);
  • delivery companies (who may process your data if you purchase goods from us and they need to be delivered or collected by you);
  • insurers (who may process your data in the limited circumstances where we assist you with arranging insurance when you purchase our goods, you active an extended warranty or policy underwritten by an insurer or we support you with a claim to an insurer);
  • customer service / customer experience partners such as Sprinklr (who may process your data to handle customer support requests and complaint resolution); and
  • our professional advisers. For example, we may share your personal data with our legal advisers should we have a claim against you or we are defending a claim made by you,  
• service providers that you have appointed and we need to contact to fulfil your requests, such as your banking or payment card provider to process your transactions;
• regulatory authorities, law enforcement agencies, public authorities, courts or other third parties on verified requests where necessary to exercise our rights or comply with a legal obligation; and
• in the event of a sale, transfer or merger of all or a part of our business or assets, we may transfer you data to the buyer and its professional advisers. Alternatively, we may seek to acquire other businesses or merger with them. If a change happens to our business, the new owners may use your personal data in the same way as set out in the Policy.

We store and process your personal data in the UK. We may, from time to time, transfer your personal data to locations outside UK (for example, because we need to share the data with a third party based outside the UK). If you are based in the EU, then this will involve a transfer outside the EU.

The locations of the third parties outside the UK or the EU (as applicable) may not have adequate data protection laws equivalent to those in place within the UK or the EU (as applicable). For transfers of your personal data to third parties outside the UK or the EU (as applicable) that have not been deemed to provide an adequate level of protection for personal data by the UK / the EU, we take additional steps where required in line with data protection laws, which may be to:

• use approved standard contractual clauses which give personal data the same protection it has in the UK or the EU (as applicable); or
• transferring data only when one or more of the conditions set out in Article 49 of the UK GDPR / the EU GDPR are met.

We are committed to securing your personal data and keeping it confidential. We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally or unlawfully destroyed, lost, altered, disclosed, used or accessed. In addition, we limit access to your personal data to those employees, agents, contractors and service providers who have a business need to know. They will only process your personal data on our instructions.

However, please note that despite our best efforts we cannot guarantee the security of information being exchanged over the internet and, where the Site contains links to other website plug-ins and applications that are not operated by us, clicking on those links or enabling those connections may allow third parties to collect or share data about you – we do not control these third party websites and are not responsible for their privacy statements. When you leave the Site, we encourage you to read the privacy policy of every website you visit.

We will only retain your personal data for the minimum period necessary to fulfil the purposes we collected it for or as required by law. As a result, the length of time that we keep your personal data for will vary depending on the purposes for which we have it. In any event, we will review what personal data we need on an ongoing basis and will only retain it for the minimum amount of time that we need it. When doing so, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

As data subject, data protection laws give you a number of rights in relation to your personal data. The rights you have are as follows:

• Right to be informed. You have the right to be informed about the collection and use of your personal data by us.
• Right of access.  You have the right to request a copy of the personal data we hold about you and to check that we are lawfully processing it. These are commonly known as “data subject access requests”.
• Right to rectify your personal data.  If you discover that the information we hold about you is inaccurate or incomplete, you can get in touch to request that the personal data we hold is corrected, although we may need to verify the accuracy of the new data you provide to us.
• Right to erasure. You may ask us to delete information we hold about you where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. However, please note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Right to restriction of processing. In some cases, you may have the right to have the processing of your personal data suspended. These circumstances are as follows:
  • if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need to establish, exercise or defend legal claims; or
  • you have objected to our use of your data but we need to verify whether we have an overriding legitimate interests grounds to use it.
• Right to object to processing. You can object to the processing of your data when we are relying on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to the processing on this ground as you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your data for the purposes of direct marketing or statistical analysis. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Right to data portability. You have the right to request that we transfer your personal data to you or, where technically feasible, to a third party where you have provided it in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time. You can request this where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain parts of the Site, the App and/or our goods and services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us at customer.data@nortonmotorcycles.com

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. It could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you are based in the UK, you have the right to make a complaint to the ICO (which you can do by telephone on 0303 123 1113 or through their website at https://ico.org.uk/global/contact-us/live-chat/ ). However, before doing so, please make sure that you have first made your complaint to us (using the contact details set out in this Policy) or asked us for clarification if there is something you do not understand.

If you are based in the EU, you have the right to make a complaint to the national data protection authority of your country. You can find the details of the national data protection authority of your country here.

We keep this Policy under regular review. This version was last updated 1 November 2025.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.