This Privacy Notice to California Residents (the “California Notice”) describes how we Collect, use and otherwise Process certain California residents’ Personal Information (“PI”) subject to the California Consumer Privacy Act (the “CCPA”), as amended, and rights such individuals may have under the CCPA.

To learn more about the Personal Information we Collect and how we Collect, use and otherwise Process it, you can click here to view our general Privacy Notice. Unless otherwise noted, the disclosures contained within this California Notice describe our current practices and our practices for the 12 months preceding the Effective Date.

This California Notice applies to only California residents that obtain and/or use our products or interact with us in an individual or household capacity in relationship to Harley-Davidson. This California Notice supplements other parts of our general Privacy Notice. In the event of a conflict between this California Notice and any other Harley-Davidson privacy notice, policy or statement, this California Notice will prevail to the extent of the conflict. Capitalized terms in this California Notice have the same meaning as the matching terms defined in the CCPA (and its implementing regulations) or our general Privacy Notice.

This California Notice does not apply to:

• Harley-Davidson personnel in relationship to their work for or on Harley-Davidson’s behalf.

• Former Harley-Davidson personnel in relationship to their work for or on Harley-Davidson’s behalf.

• Harley-Davidson employment applicants.

• Individuals who interact with Harley-Davidson in their capacity as an employee or representative of another business or entity that does business with Harley-Davidson.

• Activity at authorized dealerships. Dealers are separate legal entities from Harley-Davidson and, under the CCPA, separate Businesses from Harley-Davidson. If you want to exercise your CCPA rights regarding Personal Information a Harley-Davidson authorized dealer may have Collected about you, you will need to contact the dealer directly about exercising your rights.

• Personal information exempt from the CCPA.

What Personal Information We Collect and Why We Collect, Use, Disclose and Otherwise Process It

Sources of Personal Information

To Whom We Disclose Personal Information

Selling and Sharing of Personal Information

Retention of Personal Information

California State Privacy Rights

How to Exercise California State Privacy Rights

Shine the Light

The CCPA defines Sensitive Personal Information as a type of Personal Information. This section describes how we Collected and used the types of Sensitive Personal Information about California residents described below. Note that the specific pieces of Sensitive Personal Information we Collected about you may vary depending on the nature of your interactions with us and may not include all of the examples listed below.

Personal Information that reveals a consumer’s precise geolocation. We Collected, and may Collect, this information from your vehicle or mobile device. We Collect, use, and disclose this information:

• To provide location-based services

• To protect and defend our rights or property

• To help prevent the loss of life or serious injury, to or help protect the personal safety of Harley-Davidson personnel, users of our vehicles, websites, or apps, our visitors, or the public

• To provide Products you request, including information you request when using our Products (for example, allowing you to check in to dealerships and rally events)

• For other purposes as authorized by the CCPA and its regulations, including undertaking activities to verify or maintain the quality or safety of services or devices that are owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance services or devices that are owned, manufactured, manufactured for, or controlled by us.
  

We do not use Sensitive Personal Information for the purpose of inferring characteristics about you, or for any other reasons besides permitted Business Purposes. For this reason, we do not treat the Sensitive Personal Information we Collect as subject to a request to limit the use of Sensitive Personal Information and, therefore, we do not offer a way for you to submit such a request.

We may also Collect, use, disclose or otherwise Process all categories of PI described above for other purposes authorized by applicable laws, including:

• to help prevent the loss of life or serious injury or to protect the personal safety of Harley-Davidson personnel, users of our motorcycles, websites, or mobile apps, our visitors, or the public;

• to detect, investigate, prevent or otherwise address fraud or other security and integrity issues;

• as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or at transfer, divestiture, or sale of all or a portion of our business or assets;

• to operate and maintain the security and integrity of our products and services; and

• to protect the rights or property of ourselves, our affiliates, or others, including by enforcing our agreements, terms, and policies.

Further, we may Deidentify your Personal Information and disclose this Deidentified information to others as permitted by applicable law. Where we Deidentify information, we will not attempt to reidentify that information.

Return to top

We Collect Personal Information:directly from you; 

• from your vehicle

• from your devices and browsers; 

• from our affiliates; 

• from authorized dealers and other repairers; 

• from Service Providers and other suppliers; 

• from business partners; 

• from law enforcement agencies, courts, regulatory agencies, and others; 

• from data providers; 

• from parties to corporate transactions; and 

• from publicly available sources.
  

Return to top

We may have disclosed, or may disclose, each category of Personal Information described above to these categories of recipients:

• companies within the Harley-Davidson, Inc. family of companies and affiliates;

• authorized Harley-Davidson dealers;

• Service Providers (such as technology partners, customer support, hosting, analytics, email delivery, marketing agencies, database management, and other suppliers);

• payment processors;

• professional advisors (such as legal, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us);

• social media networks and advertisers (for example, we may share with social media networks the actions that you take on our websites and information Collected from cookies and other similar tracking technologies);

• joint marketing partners;

• other customers and the public (for example, we may provide functionality that enables you to disclose Personal Information to the public and to Harley-Davidson customers related to exchanging ideas or otherwise communicating); and

• other companies that we work with to offer products and services to our customers.

We have also disclosed, or may disclose, each category of Personal Information described above in other circumstances when required to or permitted by law. These circumstances include:

• to businesses we partner with to provide products requested by you;

• to outside parties when disclosures are required or permitted by law to defend against legal claims;

• to law enforcement agencies, courts, regulatory agencies and others when the disclosure is required or permitted by law, including to comply with valid legal process; and

• to parties with whom we are involved in a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or at transfer, divestiture, or sale of all or a portion of our business or assets.
  
  

Return to top

This section describes the categories of Personal Information Sold to Third Parties (other than Sharing for cross-contextual advertising purposes) or Shared with Third Parties for Cross-Context Behavioral Advertising in the preceding 12 months. We offer you the ability to opt out of these disclosures as set forth in the “California State Privacy Rights” section.

We do not knowingly Sell or Share the Personal Information of minors under 16 years of age.

Return to top

We keep the categories of Personal Information described above for as long as is necessary for the purposes described in this California Notice or otherwise authorized by law.

This generally means holding each category of Personal Information for as long as one of the following criteria apply:

• whether your Personal Information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we Collected the information;

• whether your Personal Information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the Personal Information was Collected;

• whether the Personal Information is reasonably required to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case); or

• whether we are otherwise required or permitted to keep your Personal Information by applicable laws or regulations.
  

Where Personal Information is used for more than one purpose, we may retain it until the purpose with the latest period expires. For more information about our retention policies, please contact us using the contact details below.

Return to top

The CCPA gives California Consumers certain rights. Where required, we will ask you to verify your identity before honoring your requests (this includes for requests made by authorized agents).

Under the CCPA, California residents have the below-listed rights.

Right to Know. You may have the right to request that we provide you with the following information:

• The categories and specific pieces of Personal Information we Collected.

• The categories of sources from which we Collect Personal Information.

• The Business or Commercial Purposes for Collecting, using, Sharing, Selling or otherwise Processing Personal Information.

• The categories of Third Parties to whom we have disclosed (including, as applicable, to whom we have Sold or Shared) your Personal Information.

Right to Delete. You may have the right to request that we delete Personal Information under certain circumstances, subject to several exceptions.

Right to Correct. You may have the right to request that we correct Personal Information that we maintain about you if you believe it is inaccurate. We may request documentation from you in connection with your request. Upon receipt of a verifiable request to correct inaccurate Personal Information, we will use commercially reasonable efforts to correct the Personal Information. You may also be able to correct certain Personal Information that we maintain about you by logging into your Harley-Davidson account.

Your Opt Out Rights. You may have the right to opt out of the Sale and/or Sharing of your Personal Information. We provide you a mechanism to opt out of Sales or Sharing of your Personal Information that we Collected via cookies or other tracking technologies through an opt out preference signal or through your cookie settings.

You may opt out of the Sale and/or Sharing of your Personal Information that we Collected via cookies or other tracking technologies through our cookie preference center by clicking on the “Manage Cookie Preferences” link in the footer of our websites. If you exercise your right in this manner, your request to opt out of the Sale and/or Sharing of your Personal Information will be linked only to your browser identifier and not linked to any account information. You will need to exercise such right on each browser from which you visit our websites.

We have also enabled the Global Privacy Control, which is designed to recognize opt out preference signals. In order to process your request through an opt out preference signal, you must use a browser or extension supporting the preference signal. If you choose to use an opt out preference signal, you will need to turn it on for each browser and each device you use and the preference signal will not apply to Personal Information not related to cookies and other tracking technologies.

If you would like to opt out of Sales and/or Sharing of Personal Information other than through cookies or other online tracking technologies, you can do so by filling out the request form here.

Right to Limit the Use of Sensitive Personal Information. We do not use Sensitive Personal Information for the purpose of inferring characteristics about you, or for any other reasons besides permitted Business Purposes. For this reason, we do not treat the Sensitive Personal Information we Collect as subject to a Limit the Use of Sensitive Personal Information request and, therefore, we do not offer a way for you to submit such a request.

Harley-Davidson will not discriminate against you for exercising any of these rights.

Return to top

You can exercise your CCPA rights, as applicable, by submitting your request(s) to us using the webform located here. You can also exercise your rights, as applicable, by calling us, toll-free, at 1-800-258-2464, Monday through Friday from 5:00 am until 8:00 pm Central time. Our call center will be closed on Sundays and on certain U.S. federal and/or state holidays.

If you want to exercise more than one of your CCPA rights, please submit a separate request for each CCPA right, so we can track and respond to your requests more effectively. Please be aware that we will process your requests in the order we receive them.

Whether you use the webform or call us, we will need information from you to process your request so that we can determine if we have Personal Information about you and verify your identity, where required. Depending on your request, we may ask for information such as your name, an email address that you have used with Harley-Davidson, or a phone number that you have used with Harley-Davidson. For certain requests, we may also ask you to provide details about the most recent purchase you made from Harley-Davidson.

Please be aware there might be circumstances where we will not honor your request, as permitted under the CCPA. For example, if we are not able to verify your identity we will not honor your request to access or delete information. In addition, we may not delete your Personal Information if an exception under the CCPA applies.

You may use an authorized agent to make requests on your behalf to exercise your rights under the CCPA. In responding to an agent’s request(s), we will require the agent to provide proof that you gave the agent signed permission to submit the request(s). Depending on the circumstances, we may also require you to (i) verify your identity directly with us and (ii) confirm with us that you provided the authorized agent permission to submit the request(s).

Return to top

We share Personal Information with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes. Californians may request information about our Personal Information sharing by contacting us at [email protected]. Please include “California Shine the Light Request” on the subject line and in the body of your message.

Please note that “Shine the Light” rights and CCPA rights are granted by different laws and must be exercised separately.


Return to top

This business-to-business notice (the “B2B Notice”) describes how Harley-Davidson Inc. (“Harley-Davidson,” “our,” “we,” or “us”) collects, uses, shares, and otherwise processes the Personal Information of California residents who interact with Harley-Davidson as an employee, owner, director, officer, or independent contractor of another company, partnership, sole proprietorship, non-profit, or government agency (collectively, “Entity”). It also explains your rights relating to Personal Information under the California Consumer Privacy Act, as amended (the “CCPA”). We use the word “you” or “your” to refer to anyone within the scope of this B2B Notice.

As used in this B2B Notice, the term “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Personal Information does not include information that is publicly available, de-identified, or aggregated.

Unless otherwise noted, the disclosures contained within this B2B Notice describe our current practices and our practices for the 12 months preceding this B2B Notice’s Effective Date

What Personal Information We Collect and Why We Collect, Use, Disclose and Otherwise Process It

Within the past 12 months, we may have Collected Personal Information about you as follows (whether we Collected a specific category of information depends on the nature of your interaction with us):

We do not Collect Sensitive Personal Information for the purpose of inferring characteristics about you. We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

Sources of Personal Information

We Collected the Personal Information and Sensitive Personal Information identified above from the following sources (whether we Collected information from a specific source depends on the nature of your interaction with us):

• Directly from you. We Collected information from you when provided it to us, such as in connection with a transaction, while interacting with our websites, when you called our call center, or while providing information in response to a survey.

• Automatically when using our digital services or visiting our premises. We Collected information about you when you used our information technology services, including our websites.

• Created by us. We Collected information about you that we created, such as credentials for access to our information technology systems or inferences generated from other information we Collect.

• Service Providers. We Collected information about you from certain service providers that provide information to help us run our business.

• Affiliates. We share Personal Information among the companies within the Harley-Davidson family of companies and affiliates. We received information within this “family,” as permitted, to enable us to manage our business and workforce.

• Law enforcement agencies, courts, regulatory agencies, and other government agencies. We may have received information from government agencies to comply with the law, to protect your personal safety or the safety of others, to protect our or others’ rights, or to investigate fraud.

• Outside parties. We may have received information about you from other outside parties when necessary to manage or operate our business. For example, in litigation settlements we may Collect information about you from outside parties related to our tax reporting obligations.

• Parties to corporate transactions. As permitted by law, we may receive Personal Information as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or at transfer, divestiture, or sale of all or a portion of a business or assets.

Disclosures of B2B Personal Information

Within the preceding 12 months, we have not Sold or Shared (for cross-context behavioral advertising) the Personal Information described in this B2B Notice.

Within the preceding 12 months, we disclosed the Personal Information described in this B2B Notice to Service Providers that help us run our business. We have also disclosed, or may disclose in the future, the Personal Information described in this B2B Notice in other circumstances when required to or permitted by law. These circumstances include:

• disclosures among the companies within the Harley-Davidson family of companies and affiliates, when permitted by law;

• disclosures to provide products or services requested by you;

• disclosures to professional advisors (such as legal, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us); 

• disclosures to other customers and the public (for example, we may provide functionality that enables you to disclose Personal Information to the public and to Harley-Davidson customers related to exchanging ideas or otherwise communicating);

• disclosures required or permitted by law to defend against legal claims;

• to law enforcement agencies, courts, regulatory agencies, and others when the disclosure is required or permitted by law, including to comply with valid legal process; and

• as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or at transfer, divestiture, or sale of all or a portion of our business or assets.

How Long We Keep Your Personal Information

We keep the categories of Personal Information described above for as long as is necessary for the purposes described in this Notice or otherwise authorized by law.

This generally means holding each category of information for as long as one of the following criteria apply:

• whether your Personal Information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we Collected the information;

• whether your Personal Information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the information was Collected;

• whether the Personal Information is reasonably required to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case); or

• whether we are otherwise required or permitted to keep your information by applicable laws or regulations.

Where information is used for more than one purpose, we may retain it until the purpose with the latest period expires. For more information about our retention policies, please contact us using the contact details below.

Submitting Requests Relating to Your Personal Information

If you are a resident of California, you have the right to submit certain requests relating to your Personal Information as described below. These rights are subject to certain requirements and we may deny such requests as permitted by applicable law. To exercise any of these rights, please submit a request through our webform. Please note that, if you submit a request to know, request to delete or request to correct, you will be asked to provide 2-3 pieces of Personal Information that we will match against our records in an effort to verify your identity.

You may use an authorized agent to make requests on your behalf to exercise your rights under the CCPA. In responding to an agent’s request(s), we will require the agent to provide proof that you gave the agent signed permission to submit the request(s). Depending on the circumstances, we may also require you to (i) verify your identity directly with us and (ii) confirm with us that you provided the authorized agent permission to submit the request(s).

Right to Know. You have the right to know what Personal Information we have Collected about you, which includes:

(1)  The categories of Personal Information we have Collected about you.

(2)  The categories and specific pieces of Personal Information we Collected.

(3)  The categories of sources from which we Collect Personal Information.

(4)  The business or commercial purposes for collecting, using, Sharing, Selling or otherwise processing Personal Information.

(5)  The categories of third parties to whom we have disclosed (including, as applicable, to whom we have Sold or Shared) your Personal Information.

Right to Delete Your Personal Information. You have the right to request that we delete Personal Information we Collected from you.

Right to Correct Inaccurate Information. You have the right to request that we correct Personal Information that we Process about you.

Harley-Davidson will not discriminate against you for exercising any of these rights.