How and when we collect your personal information

Information you provide:

• When you visit our dealerships;
• When you browse our websites;
• When you call our internal sales representatives;
• When you subscribe to BRP's newsletters;
• When you participate in contests and sweepstakes sponsored by BRP;
• When you register for and attend events sponsored by BRP;
• When you request a quote or additional information through our online forms;
• When you book an adventure through our online forms;
• When you start a conversation with our chatbots;
• When you manage your online notification choices in your preference center;
• When you register your BRP product for ownership, safety recall and warranty purposes;
• When you participate in a survey;
• When you contact our customer service group for help with your BRP products or for after-sales service.

Types of personal information we collect about you:

• Your identification information, such as your full name;
• Your contact details, such as your telephone number, postal address or email address;
• Your account login information, such as username and authentication methods;
• Your preferences, such as your language;
• Your comments, opinions and reviews on our products and services;
• Information about your personal or professional situation such as your family situation, your profession, or your income bracket;
• The content you share with us, such as photos of your adventures with our vehicles.

-----------------------------------------

Information you provide:

• When you use the BRP GO! mobile app;
• When you allow geolocation on the BRP GO! mobile app;
• When you enable geolocation on BRP Connect features;
• When you activate your vehicle through our activation processes on our websites or other mobile applications such as BRP GO!

Types of personal information we collect about you:

• Your location information using your mobile device's GPS, such as the start and end times of your trip, speed, direction, longitude and latitude, your country, and postal code;
• The points of interest that you save;
• Your feedback regarding the use of our mobile applications such as BRP GO!;
• Aggregated information about your location, combined with your driving behavior.

-----------------------------------------

Information you provide:

• When you enable cookies on our websites and mobile applications, these cookies and similar technologies collect your information – Please see the section HOW WE USE COOKIES AND SIMILAR TECHNOLOGIES for more information.

Types of personal information we collect about you:

• Information about the type of device you use to access our websites;
• The operating system version, the brand and model of your device;
• Your IP or MAC address;
• Your general geographic location as indicated by your IP address;
• Your browser type;
• The web pages that you view on our website or on the websites of our dealers or distributors;
• If and how you interact with the content available on these websites.

-----------------------------------------

Information you provide:

• When you purchase or use a BRP product or service, such as a BRP vehicle, through BRP directly or through a BRP dealer or distributor.

Types of personal information we collect about you:

• Your full name;
• Your full address;
• Your phone number;
• Your email address;
• Your ownership or purchase history;
• Your language of communication;
• Your payment information, such as your credit or debit card number (in certain circumstances) so that your purchase can be completed;
• Information about your vehicle, such as the model, vehicle identification number (VIN), mileage and configuration details;
• Other information about sales and services.
  When we process your payment information, it is generally handled by a third party via secure methods and is not stored in our systems.

-----------------------------------------

Information you provide:

Information collected automatically:

When you browse our websites or mobile applications using cookies or similar technologies for which your consent is not required - Please see the section HOW WE USE COOKIES AND SIMILAR TECHNOLOGIES for more information.

Types of personal information we collect about you:

• Your information about the type of device you use to access our websites;
• Your device's operating system and version;
• Your IP or MAC address;
• Your general geographic location as indicated by your IP address;
• Your browser type;
• Your browsing behavior, for example the web pages you visit on our website or on those of our dealers or distributors;
• Your interaction with our content available on our websites and mobile applications;
• Your vehicle information, such as location and movements, other usage or telemetry data, vehicle serial number, purchase and delivery date, unit usage;
• Your unique user ID associated with your mobile or internet application, like an advertising ID.

-----------------------------------------

Information you provide:

Information gathered from other sources:

We may receive information about you from:

• Our dealers and partners with whom we offer services or engage in joint marketing activities (for example, during competitions and prize draws);
• Social media platforms such as Facebook/Meta, Google, Twitter, LinkedIn, Instagram, when you interact with us on these platforms;
• Driving schools when you participate in joint programs.

Types of personal information we collect about you:

• Your demographic information such as full name, email, language;
• Your interaction with social media platforms such as:
  o User behavior, by tracking time spent on pages, links users chose to click on, and what users like or dislike;
  
  o User device, in particular IP address (captured and stored only in anonymized form), screen size, type (unique device identifiers), browser information, geographical location (country only), preferred language used for display on our website;
• Your assigned BRP GO! customer identification number (customer ID).

BRP processes your personal information for the following reasons:

Our reasons

Manage your order for BRP products and services, purchased directly from us or through our network of dealers and distributors.

In detail

• Processing your order;
• Complete your order and provide you with the requested products and services;
• Maintaining your BRP product;
• Coordinate with our service providers the delivery of your order or the provision of the requested service;
• Configure your BRP product or activate features;
• To provide you with information or content that may be relevant to you, for example, to warn you when your vehicle may need servicing and to locate the nearest dealership;
• To follow up on your purchase or use of our services, for example, to obtain your feedback and measure customer satisfaction through surveys;
• Manage your BRP account;
• Manage your registration for our events or competitions;
• Calculate the taxes on your order;
• Comply with applicable laws and regulations.

---------------------------------------

Our reasons

To personalize your experience, our products and services, and our interactions with you

In detail

• Use geolocation and location-based technologies if you enable these technologies to:

o To provide you with information or content that may be relevant to you, for example for the creation and execution of your journey;

o To notify you when your vehicle needs maintenance;

o Locate the nearest dealership.

• Using technologies to evaluate some of your characteristics based on your data, interests, or behavior ("profiling") in order to:

o Create your personalized profile on your products, your behavior and your characteristics in our internal databases;

o Create consumer segments;

o To personalize our interactions with you, including sending personalized communications and marketing materials;

o Sending you promotional material in your preferred language and about a specific product that can improve your current use of the vehicle.

---------------------------------------

Our reasons

Manage your BRP product registration, warranty, security, safety recalls, and dispute resolution.

In detail

• Register your BRP product;
• Establish ownership of individual BRP products;
• Protecting your safety and security;
• Conduct safety reminders;
• We offer you a warranty and after-sales service;
• Detect and prevent thefts;
• Manage disputes involving you, other employees, or third parties;
• Enforcing our contracts;
• Comply with applicable laws and regulations.

---------------------------------------

Our reasons

Providing support, assistance, and after-sales service to customers

In detail

• Responding to customer requests;
• Diagnose product-related problems;
• To inform you of problems related to your vehicle;
• Helping you resolve delivery problems;
• Establish ownership of your vehicle and manage any related transfers or disputes;
• Processing returns;
• To offer after-sales service;
• Repairing BRP products;
• Resolve technical or other problems related to the delivery of BRP vehicles and services;
• Continuously improve product quality;
• To verify information by cross-checking in certain circumstances, for example in the context of warranty claims or to verify whether recalls have been carried out correctly;
• Keeping you informed about a request for support;
• Sending you notices and usage violations regarding your use of our mobile applications such as BRP GO!;
• To provide other customer service and support services, including your requests to exercise rights relating to your personal information;
• Comply with applicable laws and regulations.

---------------------------------------

Our reasons

Send commercial communications

In detail

• To provide you with information about your account or about a BRP product you own or a service you receive;
• To inform you about new BRP products, services or features;
• Share news about contests, promotions and events or discuss products or services offered by BRP that may interest you.

---------------------------------------

Our reasons

Conducting online behavioral advertising through cookies and similar technologies

In detail

• Understanding how you interact with our websites, mobile applications, products or services, and advertisements on third-party websites, such as Facebook/Meta;
• To measure the effectiveness of our web pages, mobile applications, products or advertisements;
• Allows us to show you more relevant ads;
• Create custom audiences on social media platforms, such as Facebook/Meta;
• Displaying advertisements via these platforms that correspond to your interests or to people that these platforms have identified as sharing similar interests.

To learn more about your choices regarding your personal information in relation to cookies and similar technologies used for online behavioral advertising, please see the section HOW WE USE COOKIES AND SIMILAR TECHNOLOGIES .

---------------------------------------

Our reasons

Perform data analysis and statistical work for business intelligence purposes

In detail

• Tailor your experience and services (including personalized marketing) based on your consumer profile;
• Creating statistics that help us analyze how to improve our products and services, for example by testing new features or analyzing the life cycle of vehicles;
• Better understand the behavior of BRP consumers and group them into categorized audiences according to established criteria;
• Developing and improving our BRP products and services and your experience, including maintaining and improving the performance of our BRP products and services, developing and adding new features or capabilities;
• Develop aggregated analyses, statistics and business intelligence that enable us to operate, protect, make informed decisions and report on the performance of our business.

---------------------------------------

Our reasons

To prevent, detect and combat fraud and any unauthorized or illegal activity

In detail

• To prevent, detect and combat fraud and any unauthorized or illegal activity
• Detect and combat fraud related to the purchase of BRP products or services;
• Managing illegal or unauthorized activities and cyber threats;
• Comply with applicable laws and regulations.

Your personal information will be shared with BRP employees who need to know it to perform their duties, as well as with authorized third parties. Therefore, the following categories of recipients have access to your personal information when necessary for the purposes described below:

Categories of recipients likely to have access to your personal information

BRP Affiliates and Subsidiaries

Reasons why they need access to your personal information

• For the uses described in this Privacy Policy;
• For internal audit purposes to monitor and improve how we operate;
• Other uses that were communicated to you before or at the time of sharing your personal information with BRP affiliates and subsidiaries.

-----------------------------------

Categories of recipients likely to have access to your personal information

Service providers:

• Call centers;
• Parts and accessories companies;
• Security companies;
• Information technology and software companies;
• Internet service providers;
• Providers of personalized online cards;
• IT hosting providers;
• Platform or tool providers (marketing platforms or customer data platforms, multichannel marketing and marketing automation companies);
• Web analytics service providers;
• Authentication service providers;
• Printing service providers;
• Cloud service providers;
• Logistics service providers;
• Payment service providers;
• IT integration or development partners;
• Insurance and financing companies;
• Mail distribution companies;
• Digital marketing companies and marketing consultants;
• Event analytics service companies;
• GPS technology companies;
• Transportation and shipping companies;
• Marketing specialists and third-party developers.

Reasons why they need access to your personal information

• To help us conduct our business and provide you with the product or service you requested.

-----------------------------------

Categories of recipients likely to have access to your personal information

Agents or subcontractors

Reasons why they need access to your personal information

• To provide services on our behalf and according to our instructions, in accordance with this Privacy Policy.

-----------------------------------

Categories of recipients likely to have access to your personal information

Advertising and market research partners

Reasons why they need access to your personal information

• Conduct marketing campaigns and market research activities on our behalf.

-----------------------------------

Categories of recipients likely to have access to your personal information

Social media platforms:

• Facebook/Meta;
• Google;
• Instagram;
• LinkedIn;
• Reddit;
• Sprout;
• Twitter.

Reasons why they need access to your personal information

• Displaying advertisements to users that match the information we provide to these platforms;
• Displaying advertisements to users who share similar characteristics;
• To enable personalized and targeted marketing;
• Measure and improve the performance of our ads on these platforms.

BRP securely transmits your email address. Information shared with social media platforms (including Facebook/Meta) will be used to measure the effectiveness of BRP's advertising campaigns and will be used by the social media platforms for their own purposes. You can limit these disclosures by opting out of online behavioral advertising. You can do this by modifying or adjusting your advertising settings (for example, on Facebook/Meta) to remove yourself from custom audience lists.

-----------------------------------

Categories of recipients likely to have access to your personal information

Authorized BRP Dealers and Distributors

Reasons why they need access to your personal information

• Providing our products and services
• You send them their own marketing communications.

-----------------------------------

Categories of recipients likely to have access to your personal information

Other third parties

Reasons why they need access to your personal information

• For the sole purpose of a purchase, sale (including liquidation, realization, seizure or repossession), lease, merger, joint venture, strategic partnership or any other type of acquisition, disposition, transfer, assignment or financing of all or any portion of BRP, or any business, asset or share of BRP or any of its divisions, proposed or actual.

-----------------------------------

Categories of recipients likely to have access to your personal information

Law enforcement authorities or government agencies and external auditors

Reasons why they need access to your personal information

• To comply with a law, regulation, search warrant, subpoena or court order;
• For internal audit purposes to monitor and improve our operations.

-----------------------------------

We take the following measures when we share your personal information with recipients:

• We use a robust security protocol with them;
• We require them to apply security and privacy standards comparable to our own;
• Through our contracts with them, we implement contractual safeguards and other measures to maintain the confidentiality and security of your personal information and to prevent your information from being used for other purposes. For example, we generally require our service providers to limit their use and retention of personal information to what is necessary to provide their services and to notify us in the event of an actual or suspected breach of confidentiality involving personal information;
• We have implemented a due diligence process to ensure they meet our requirements. This includes assessing their security practices, privacy policies, and compliance with applicable regulations;
• Access is strictly limited to those who need to use it for the intended purpose;
• When your personal information is made accessible or transferred to a third party located outside your country of residence, we implement additional contractual safeguards to ensure that your personal information remains protected. Please read the ADDITIONAL COUNTRY-SPECIFIC PRIVACY POLICIES to learn more about the safeguards we implement, as these may vary from country to country.

Your personal information is retained only for as long as necessary to achieve the purposes for which it was collected or used, or as permitted or required by applicable laws.

We retain your personal information for:

• the purposes described in this Privacy Policy;
• the purposes that were communicated to you before or at the time of the collection of your personal information;
• our own legitimate business needs;
• compliance with our legal or regulatory obligations;
• to establish, exercise or defend our rights;
• to prevent, detect and investigate fraud.

If your personal information is needed to fulfill multiple purposes, we will retain it until the end date of the longest-lasting purpose. In all cases, we will cease using information for purposes with an earlier end date as soon as that date is reached.

Personal information that is no longer needed is either irreversibly anonymized or securely destroyed in accordance with applicable laws.

To learn more about our retention and destruction policies and practices, including how long we retain your personal information, you can contact our Privacy Officer as indicated in the HOW TO CONTACT US section at the beginning of this Policy.

In addition to the safeguards detailed in the section WHO WE SHARE YOUR PERSONAL INFORMATION WITH , BRP ensures that your personal information is protected against loss and unauthorized access, use, or disclosure throughout its lifecycle. Your personal information is kept secure, and access to it will be strictly limited to those individuals who need it for the relevant activities. BRP employs physical, technical, and organizational measures to ensure that your personal information receives an adequate level of protection while it is under our control, including when your personal information is transferred to one of our recipients located outside your country of residence.

Our websites and mobile applications may contain links to third-party websites. The operators of these linked websites may also collect your personal information (including information generated through the use of cookies and payment data) when you use their websites. To the extent permitted by applicable law, BRP is not responsible for how these third parties collect, use, or disclose your personal information. It is important that you familiarize yourself with their privacy policies before providing them with your personal information.

BRP's websites, apps, mobile apps, products, and services are not targeted at, or intended for use by, children. We do not knowingly collect personal information from children under the age of 16. Children under the age of 16 should not register with or provide any personal information to BRP without the consent of a parent or legal guardian.

If you believe we have received personal information from children under the age of 16, please contact us as described in the HOW TO CONTACT US section at the beginning of this Policy.

Your rights depend on your country of residence and the laws or regulations that apply to your situation, but in most cases, you have the right to:

• Request that we confirm whether we hold personal information about you and that we give you access to that information;
• Request the deletion of your personal information;
• Correct your personal information if it is inaccurate or no longer up to date;
• Ask a question about how we handle your personal information;
• To file a complaint regarding the processing of your personal information;
• Please stop sending us our marketing communications.

Please read the relevant section in the ADDITIONAL PRIVACY POLICIES BY COUNTRY to learn more about other rights relating to your personal information.

Commercial communications

We use your contact information to communicate with you by email or other electronic means, such as text messages or telephone. You can always ask us to stop sending you marketing communications. The easiest way to do this is to withdraw your consent, which you can do at any time by clicking the unsubscribe link at the bottom of any newsletter or marketing communication, or by contacting our Privacy Officer as described in the HOW TO CONTACT US section at the beginning of this Policy.

However, when you withdraw your consent to receive marketing communications from BRP, you may continue to receive marketing communications from our dealers and distributors, who have their own independent consent management systems. The reverse is also true; you may continue to receive marketing communications from us if you unsubscribe only from those sent by our dealers and distributors.

Other rights specific to the use of certain BRP websites or mobile applications

When you use some of our mobile applications or websites, depending on their features, you may:

• Modify your profile to ensure that only certain information can be read by other users;
• Deciding not to provide some of the requested information (this may limit some of the jobs and features available to you);
• Disable or block the sharing of your location when using the website or mobile application, including when participating in group driving events;
• Modify your location settings and access permissions in your device settings to ensure that this data is only shared between your device and the application while you are using it. Further restricting access to location information may prevent you from using some or all of the website or application's features.
• Accept or decline to receive "push" type notifications relating to the website or mobile application, which are sent to alert you to new information;
• Delete the mobile app or your account at any time. Doing so will result in the deletion of certain information, such as your planned and completed routes, route statistics, points of interest, saved places, and friends, if applicable.

How to exercise your rights

If you wish to exercise any of the rights listed above or in the dedicated section of the ADDITIONAL COUNTRY PRIVACY POLICIES , you may make a request by contacting our Privacy Officer as indicated in the HOW TO CONTACT US section at the beginning of this Policy. BRP may require relevant information or details to properly authenticate you. Once available, you will also be able to submit your privacy requests directly online through our Privacy Rights Portal (coming soon).

If you wish to exercise a specific right to use certain BRP websites or mobile applications, you can do so by following the procedure indicated in the terms and conditions of the website or mobile application you are using.

Please note that applicable laws may restrict or limit your rights, which means that in certain situations, as permitted by applicable law, we are entitled to refuse your request. In all cases, we will explain why we cannot fulfill your request, as permitted by law.

Only you or an authorized representative can make a verifiable request regarding your rights to your personal information. You may be asked to provide proof of identity to make a request regarding your rights to your personal information, and we may not be able to respond to your request if we are unable to confirm your identity or link the information you submit in your request with the personal information we hold.

We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we believe the request warrants a fee, we will explain the reasons for this decision and provide you with a cost estimate before processing your request.

Complaint resolution

We are committed to working with you to resolve any concerns you may have about our use of your personal information or to obtain a fair resolution to any complaint. However, if you feel we have not been able to address your complaint or concern, you may have the right to lodge a complaint with your country's data protection authority or supervisory authority. For more details, please see the dedicated section in the ADDITIONAL COUNTRY-SPECIFIC PRIVACY POLICIES.

This Privacy Policy will be amended from time to time. When this happens, we will notify you by updating the "Last Updated" date at the top of this Privacy Policy or by other means of communication as appropriate. We recommend that you occasionally check this website for any changes.

What is a connection indicator?

A cookie is a small text file placed on your computer when you visit a website. It is usually created when a new web page loads.

Cookies store information on your computer or device to manage your experience on the website. They allow a small amount of data specific to a particular user and website to be retained so that the web pages displayed can be tailored to that individual user. Some pages contain a script that considers the data contained in the cookie and is therefore able to carry information from one visit to the website (or a related website) to the next. Cookies also contain information about your preferences to personalize your visit to the website. Most browsers allow you to manage cookies through their settings preferences.

Connection logs and other tracking technologies used by BRP

Strictly necessary connection cookies
These cookies are always active because they are necessary for the website/mobile application to function. They respond to your actions on the site's pages, including logins, language preferences, navigation settings, and autofill forms.

Facebook Pixel/Meta
These cookies are provided by Facebook/Meta and help us measure the effectiveness of our ads by understanding the actions visitors take when they visit our websites or mobile apps. This allows us to create custom audiences on the social media platform and deliver ads to users that match the characteristics of those audiences. You can manage your privacy and advertising preferences in your Facebook/Meta account settings.

Marketing testimonials
These cookies are used by BRP and third parties to build a profile of your interests, provide you with relevant communications, and analyze and understand advertising effectiveness. They track data such as the number of unique visitors, ad clicks, and recently viewed pages. They are also used to build consumer profiles to display ads based on products viewed or actions taken on BRP websites/mobile apps. Disabling these cookies will prevent you from receiving targeted advertising across different websites/mobile apps.

Analysis witnesses
We use analytics service providers, such as Google Analytics, to obtain aggregated or statistical data about the actions taken by visitors to our websites or mobile applications. This helps us understand how our websites and mobile applications are used and improve our services. You can disable Google Analytics by using a browser add-on.

We also use services that allow us to better understand our users' needs and optimize our platform and user experience. These services use cookies and other technologies to collect data on:

• The behavior of our users, by tracking the time spent on pages, the links that users chose to click on, what users like or dislike;
• On users' devices, in particular the IP address (captured and stored only in anonymized form), screen size, type (unique device identifiers), browser information, geographic location (country only), preferred language used for display on our website/mobile application.

This information is stored in a pseudonymized user profile, and it will not be used to identify individual users or to match it with other data about an individual user.

Retargeting indicators/behaviors/statistics
These cookies are used by BRP and third parties to create groups or lists of users who have interacted in a particular way with BRP websites/mobile applications. These cookies do not contain any identifiers or personal data.

Transparent GIFs
Clear GIFs (also known as web beacons, web bugs, or pixel tags) are tiny graphics with a unique identifier, similar in function to cookies. Unlike cookies, however, clear GIFs are invisibly embedded in web pages and are not stored on your hard drive. These "images" are automatically loaded into your browser/device when you visit our website or open an HTML email from us, allowing us to know if a particular page has been visited or an email opened. Clear GIFs enable us to record simple user actions on our websites and in our emails, helping us determine the usage and effectiveness of our site and communications. We may use clear GIFs to track visitor activity, help us manage content, and compile usage statistics.

We and our third-party service providers may also insert transparent GIFs into HTML emails sent to our customers to help us track response rates, identify when our emails are opened, and determine if our emails are being forwarded to other users. You can block these GIFs using a third-party application or, in the case of email, by changing your settings to prevent image downloads (if your email client supports this feature).

Your cookie settings

You can disable some or all cookies at any time in your browser's advanced settings. For more information about BRP's use of cookies, please see our Cookie Policy .

This section supplements the information contained in our Privacy Policy and applies only to customers, visitors, users and other persons residing in the states of California, Virginia, Connecticut, Colorado, Utah, Oregon, Texas and Montana (“consumers” or “you”).

Information we collect and process

BRP US Inc., as the data controller of your personal information, together with Bombardier Recreational Products Inc., processes the following categories of personal information, as indicated by a "Yes" below:
--------------------------------

Category A – Identifiers

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Full name, address, email.

--------------------------------

Category B – Personal information, including that defined in section 1798.80(e) of the California Civil Code

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Name, signature, address, telephone number, driver's license or identity card number, employment, other financial information.

--------------------------------

Category C – Characteristics of the classification protected under state (including federal) laws

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Age, gender. We have access to age ranges and gender information on an aggregated basis through Google Analytics, which we use for statistical purposes.

--------------------------------

Category D – Commercial

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Transaction information, purchase history such as vehicles, products or services purchased, purchasing trends, payment information.

--------------------------------

Category F – Activity on the internet or other electronic networks

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Browsing history, search history, online behavior, interest data and interactions with our websites, applications, systems and advertisements.

--------------------------------

Category G – Geolocation

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Location of the device or vehicle.

--------------------------------

Category H – Audio, electronics, visual and similar

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: Recordings of service calls, images and 3D models created as part of our business activities.

--------------------------------

Category K – Inferences drawn from any of the personal information listed above

Collected by BRP? Yes

Disclosed by BRP to third parties in the last 12 months, including for commercial purposes? Yes

Examples: To create a profile or summary regarding, for example, an individual's preferences and the likelihood of purchasing our vehicles, products or services.

--------------------------------

Categories A, B, C, D, F, G and K may constitute sensitive personal information, depending on the nature of the services and the context.

Sale of personal information

We do not sell your personal information to third parties for commercial purposes unless you expressly authorize us to do so.

Over the past twelve (12) months, we have not sold any personal information. Please also note that any third party that purchases personal information we hold may not resell it unless you have received explicit notification and the opportunity to opt out of any further sales.

Your rights and your choices

The following rights are in addition to those described in the section YOUR RIGHTS RELATING TO YOUR PERSONAL INFORMATION:

California

• Right to information. You have the right to know how your personal information is processed by BRP and to ask us any questions about it.
• Right to request that we disclose to you :

or if we process your personal information and, where applicable, the categories of personal information we have collected about you and the categories of sources from which we collected it;

o the specific elements of the personal information we have collected about you;

the business purpose or activities for which we collected personal information about you; and

o the categories of personal information about you that we have shared or disclosed and the categories of third parties with whom we have shared or disclosed this information during the previous 12 months.

• Right to request the deletion of personal information we have collected from you, subject to certain exceptions.
• The right not to be discriminated against because you are exercising one of your rights , by refusing you a good or service, by charging you a different price or rate for a good or service, or by providing you with a different level of quality of a good or service.
• Right to demand at any time that BRP not sell or share your personal information (the "opt-out right").
• Right to request that we limit at any time the use and disclosure of sensitive personal information to the use necessary for the performance of services or the provision of goods.
• Right to ask us to correct inaccurate personal information about you , taking into account the nature and purposes of the processing of personal information.
• The right not to be subject to reprisals for exercising your rights.
• Right to obtain a copy of the personal information you have previously provided to us in a portable and, where technically feasible, easily usable format.

Virginia

You have all the rights mentioned above, as well as the following rights:

• Right to object to the processing of your personal information for the purposes of targeted advertising, the sale of your personal information or profiling for the purpose of decisions producing legal or similar significant effects concerning you.
  

Colorado

• Right to information . You have the right to know how your personal information is processed by BRP and to ask us any questions about it.
• Right to ask us to correct inaccurate personal information about you , taking into account the nature and purposes of the processing of personal information.
• Right to object to the processing of your personal information for the purposes of targeted advertising, the sale of your personal information (applicable from 1 July 2024) or profiling for the purpose of decisions producing legal or similar significant effects concerning you.
• Right to request the deletion of personal information we have collected from you , subject to certain exceptions.
• The right not to be discriminated against because you are exercising one of your rights , by refusing you a good or service, by charging you a different price or rate for a good or service, or by providing you with a different level of quality of a good or service.
• Right to obtain a copy of the personal information you have previously provided to us in a portable and, where technically feasible, easily usable format , where the processing is carried out by automated means.

Connecticut

• You have the same rights as the State of Colorado, but you also have the right not to be discriminated against as a result of the processing of your personal information in a way that violates state or federal laws prohibiting unlawful discrimination against you. All of your rights are effective as of July 1, 2023.
  

Utah (applicable from December 31, 2023)

• Right to information. You have the right to know how your personal information is processed by BRP and to ask us any questions about it.
• Right to request the deletion of personal information we have collected from you , subject to certain exceptions.
• The right not to be discriminated against because you are exercising one of your rights , by refusing you a good or service, by charging you a different price or rate for a good or service, or by providing you with a different level of quality of a good or service.
• Right to obtain a copy of the personal information you have previously provided to us in a portable and, where technically feasible, easily usable format , where the processing is carried out by automated means.
• Right to refuse the processing of your personal information for the purposes of targeted advertising or the sale of your personal information.
  
  

Oregon (applicable from July 1, 2024)

• You have the same rights as the State of Colorado, but your right to opt out of the processing of your personal information for targeted advertising, the sale of your personal information, or profiling for decisions producing legal or similar significant effects concerning you becomes applicable as of January 1, 2026.

Texas (applicable from July 1, 2024)

• You have the same rights as the State of Colorado, but you also have the right not to be discriminated against in the handling of personal information in violation of federal or state laws prohibiting unlawful discrimination against you.

Montana (applicable from October 1, 2024)

• You have the same rights as the State of Colorado, but you also have the right not to be discriminated against in the handling of personal information in violation of federal or state laws prohibiting unlawful discrimination against you.
  

Exercising your rights

You can exercise these rights by contacting our Privacy Officer as described in the HOW TO CONTACT US section at the beginning of this Policy.

To exercise your right to withdraw consent and limit the use and disclosure of sensitive personal information, you can also submit a request by clicking here: Do not sell or share my personal information or here: Limit the use and disclosure of sensitive personal information .

Call

If you reside in California, Colorado, Virginia, or Connecticut, you may appeal our refusal to comply with a request within the time limit prescribed by applicable law after being notified of our decision. To exercise your right of appeal, you may contact our Privacy Officer as described in the HOW TO CONTACT US section at the beginning of this Policy or by calling 1-888-272-9222.

This section supplements the information contained in our Privacy Policy and applies only to customers, visitors, users and other persons who reside in the province of Quebec (Canada).

Data Governance and Security

BRP applies governance policies and practices that ensure the protection of your personal information. In addition to the measures detailed in the section WHO WE SHARE YOUR PERSONAL INFORMATION WITH, depending on the volume and sensitivity of the information, the purposes for which it is used, and the format in which it is stored, we implement a combination of measures to protect your personal information, including:

• Internal policies and procedures defining the roles and responsibilities of our employees throughout the information lifecycle;
• Employee training on the protection of personal information and data security;
• The appointment of our Privacy Officer, responsible for monitoring and managing BRP's compliance with applicable privacy laws. The role and responsibilities of our Privacy Officer include, but are not limited to:

o Approval of internal policies and practices relating to the protection of personal information;

o Assistance in conducting privacy impact assessments (where required by law); and

o Respond to requests for rights relating to personal information in accordance with this Privacy Policy and applicable laws;

• Procedures for receiving, investigating and responding to complaints or inquiries regarding BRP's practices in handling personal information, including any breach of confidentiality involving personal information and any request by an individual to exercise their rights relating to their personal information;
• Access management systems that limit access to your personal information to employees or service providers who have a business need consistent with the reason the information was provided;
• Generally accepted information security techniques, such as firewalls, data encryption, antivirus software, and access management procedures;
• The framework limits our retention of personal information to what is necessary to achieve the purposes described in this Privacy Policy, including providing you with the requested products or services. This framework also governs the destruction of your personal information and is described in more detail in the section HOW LONG WE RETAIN YOUR PERSONAL INFORMATION above.

Transfer of personal information outside the province of Quebec

For personal information concerning residents of Quebec, transfers of personal information outside the province will be carefully reviewed before the transfer and an assessment will be carried out to ensure that they fall within the limits of the applicable law and that the jurisdiction where the personal information is received offers adequate guarantees.

Rights relating to your personal information

As a resident of Quebec, in addition to the rights relating to your personal information described in the section YOUR RIGHTS RELATING TO YOUR PERSONAL INFORMATION , you have other rights relating to your personal information, such as:

• Right to information . When collecting your personal information and subsequently upon request, BRP must inform you:

o the purposes for which your information is collected;

o the means by which information is collected;

of your right of access and rectification;

o of your right to withdraw your consent to the communication or use of the information collected;

o third parties for whom the information is collected (if applicable);

o the category of third parties to whom it is necessary to communicate your information (if applicable);

o the possibility that the information may be disclosed outside of Quebec (if applicable);

o personal information that is collected from you (on request);

o the categories of people who have access to information within BRP (on request);

o the retention period for information (on request);

o the contact details of our Privacy Officer (on request);

o the source of the information, if BRP collects your personal information from another third party (on request).

• Right to request that the dissemination or deindexing of your personal information cease . You may require BRP to cease disseminating this information or to deindex any hyperlink associated with your name that allows access to this information by technological means, if the dissemination of this information contravenes an applicable law or a court order.
• Right not to be subject to an automated decision . If BRP makes a decision based solely on automated processing of your personal information, you have the right to be informed of this at the latest when we inform you of the decision. You also have the right to be informed, upon request, of the personal information used to make the decision, the reasons for it, and the main factors and parameters that led to the decision, and to have the personal information used to make the decision corrected. You also have the opportunity to submit comments to a member of BRP staff who is able to review the decision.
• Right to data portability (effective September 22, 2024). You can request that BRP provide you with computerized personal information collected from you in a structured and commonly used technological format.

You can exercise these rights by contacting our Privacy Officer as described in the HOW TO CONTACT US section at the beginning of this Policy.

You can also file a complaint with Quebec's personal information protection authority, the Commission d'accès à l'information du Québec.

This section supplements the information contained in our Privacy Policy and applies only to customers, visitors, users and other persons who reside in the European Union, Iceland, Norway, Liechtenstein, the United Kingdom or Switzerland (“ Europe ”).

Bombardier Recreational Products Inc., whose head office is located at 26 Saint-Joseph Street, Valcourt (Quebec) J0E 2L0, Canada, and BRP European Distribution SA, whose head office is located at 4-6 Avenue d'Ouchy, 1006 Lausanne (Switzerland), are considered "data controllers" under applicable laws, as BRP determines how and why it processes your personal information.

BRP processes your personal information in the manner described below:

-----------------------------------

Our reasons:

Manage your order for BRP products and services: purchased directly from us or through our network of dealers and distributors

• Processing your order;
• Complete your order and provide you with the requested products and services;
• Maintaining your BRP product;
• Coordinate with our service providers the delivery of your order or the provision of the requested service;
• Configure your BRP product or activate features;
• Manage your BRP account;
• Manage your registration for our events or competitions.
• To track your purchase or use of our services (for example, to obtain your feedback and measure customer satisfaction through surveys).
• Calculate the taxes on your order.

Our legal justifications:

• Necessary for the execution of the contract we have entered into with you.

Depending on the circumstances, either

• With your consent;
• Our legitimate interest in continuously improving and developing our products and services.
• To comply with our accounting, tax and management obligations under the laws and regulations that apply to us.

-----------------------------------

Our reasons:

To personalize your experience, our products, our services, and our interactions with you

• Use geolocation and location-based technologies if you enable these technologies to:

o To provide you with information or content that may be relevant to you;

o To notify you when your vehicle needs maintenance;

o Locate the nearest dealership.

• Using technologies to evaluate some of your characteristics based on your data, interests, or behavior ("profiling") in order to:

o Create your personalized profile on your products, your behavior and your characteristics in our internal databases;

o Create consumer segments;

o To personalize our interactions with you, including sending personalized communications and marketing materials;

o Sending you promotional material in your preferred language and about a specific product that can improve your current use of the vehicle.

Our legal justifications:

Depending on the circumstances, either:

• With your consent;
• Based on our legitimate interest in getting to know you better, personalizing your experience, our products and services, and our interactions with you.

-------------------------------------

Manage your BRP product registration, warranty, security, safety recalls, and dispute resolution.

• Register your BRP product;
• Establish ownership of individual BRP products;
• We offer you a warranty and after-sales service.
• Protecting your safety and security;
• Conduct safety reminders.
• Manage disputes involving you, other employees, or third parties;
• Enforcing our contracts;
• Detect and prevent theft.

Our legal justifications:

Necessary for the execution of the contract we have entered into with you.

Depending on the circumstances, either:

• To comply with the obligations incumbent upon us under the laws and regulations that apply to us, for example, laws on product or manufacturer liability;
• Our legitimate interest in quality control.

Our legitimate interest in protecting, establishing, exercising or defending our rights or in the context of any ongoing or future legal proceedings.

-------------------------------------

Providing support, assistance, and after-sales service to customers

• Responding to customer requests;
• To inform you of a support issue;
• To provide other customer service and support, including your requests relating to your rights concerning your personal information.
• Helping you resolve delivery problems;
• Processing returns;
• To offer after-sales service;
• Repairing BRP products;
• Establish ownership of your vehicle and manage any related transfers or disputes;
• Cross-checking information in the context of warranty claims.
• Diagnose product-related problems;
• To inform you of problems related to your vehicle;
• Resolve technical or other problems related to the delivery of BRP vehicles and services;
• Cross-check the information to verify that the reminders were carried out correctly.
• Sending you notices and usage violations regarding your use of our mobile applications such as BRP GO!

Our legal justifications:

Depending on the circumstances, either:

• Our legitimate interest in providing you with a response to your request or problem;
• To comply with our obligations under privacy laws to manage and process your requests in this regard.
• Necessary for the execution of the contract we have entered into with you.
• Depending on the circumstances, either: To comply with the obligations incumbent upon us under the laws and regulations applicable to us, for example, product or manufacturer liability laws; Our legitimate interest in ensuring quality.
• Our legitimate interest in protecting, establishing, exercising or defending our rights or in the context of any ongoing or future legal proceedings.

-------------------------------------

Send commercial communications

• To provide you with information about your account or about a BRP product you own or a service you receive;
• To inform you about new BRP products, services or features;
• To inform you of security updates and other types of updates;
• Share news about contests, promotions and events or discuss products or services offered by BRP that may interest you.

Our legal justifications:

Depending on the circumstances, either:

• With your consent to receive our marketing communications;
• Our legitimate interest is to promote our products and services by sending you news and content about our products and services and/or to keep our websites, applications and computer systems safe and secure.

-------------------------------------

Perform data analysis and statistical work for business intelligence purposes

• Creating statistics that help us analyze how to improve our products and services, for example by testing new features or analyzing the life cycle of vehicles;
• Developing and improving our BRP products and services and your experience, including maintaining and improving the performance of our BRP products and services, developing and adding new features or capabilities;
• Develop aggregated analyses, statistics and business intelligence that enable us to operate, protect, make informed decisions and report on the performance of our business.

Our legal justifications:

Depending on the circumstances, either:

• With your consent for cookies;
• Our legitimate interest in creating trends and reports for business intelligence purposes, for example to create global trend reports and measure customer satisfaction, improve the quality of our products and services and measure our performance, including the effectiveness of our marketing strategies and content.

-------------------------------------

To prevent, detect and combat fraud and any unauthorized or illegal activity

• Detect and combat fraud related to the purchase of BRP products or services;
• Managing illegal or unauthorized activities and cyber threats.

Our legal justifications:

Depending on the circumstances, either:

• To comply with our obligations under applicable laws and regulations, for example, anti-fraud laws;
• Our legitimate interest in protecting our brand and image against the losses and impacts of fraud.

-------------------------------------

Conducting online behavioral advertising through cookies and similar technologies

• Understanding how you interact with our websites, mobile applications, products or services, and advertisements on third-party websites, such as Facebook/Meta;
• To measure the effectiveness of our web pages, mobile applications, products or advertisements;
• Allows us to show you more relevant ads;
• Create custom audiences on social media platforms, such as Facebook/Meta;
• Displaying advertisements via these platforms that correspond to your interests or to people that these platforms have identified as sharing similar interests.

To learn more about your privacy choices regarding cookies and similar technologies used for online behavioral advertising, please see the section HOW WE USE COOKIES AND SIMILAR TECHNOLOGIES .

Our legal justifications:

Depending on the circumstances, either:

• With your consent for cookies;
• Our legitimate interest is to get to know you better, to personalize your experience, our products, services and interactions with you, to understand how users interact with our websites and applications to improve the user experience, and to measure our audience and the effectiveness of our marketing strategies and content.

-------------------------------------

International transfers of personal information

If your personal information is transferred outside of Europe, the following measures apply:

• Your personal information is transferred to a country considered by the European Commission to offer adequate protection, such as Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom or Uruguay;
• Standard European Contractual Clauses (SCCs) under the General Data Protection Regulation 2016/679 (GDPR) have been signed with third parties, as the SCCs provide appropriate data protection safeguards. BRP incorporates the SCCs annexed to European Commission Implementing Decision 2021/914 of 4 June 2021 for the transfer of personal data to third countries in accordance with the GDPR, as well as the SCCs as amended by the addendum on international data transfers published by the UK Information Commissioner's Office under S119A(1) Data Protection Act 2018. The SCCs are incorporated into the contracts concluded between BRP and third parties who manage personal data on its behalf.

Rights relating to your personal information

In addition to the privacy rights described in the section YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION , you have other rights regarding your personal information, such as:

• Right to information. You have the right to know how your personal information is processed by BRP and to ask us any questions about it.
• Right to object to the processing of your personal information. You can ask BRP to stop processing your personal information, including for profiling purposes, and you can object at any time to receiving our marketing communications.
• Right to withdraw your consent . If you have already given us your consent, you can withdraw it at any time.
• Right to request restriction of the processing of your personal information. You can ask BRP to temporarily freeze or limit the processing of your personal information, for example if you believe that your personal information is inaccurate.
• Right to request the erasure of your personal information (“right to be forgotten”).
• Right to request the portability of your personal information. You can request to receive your personal information in a structured, commonly used and machine-readable format or request that your personal information be transferred by BRP to a third party.
• Right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning you or significantly affects you. In this case, you can request human intervention to review the automated decision, express your point of view, and contest the decision.
• You have the right to define instructions regarding the management of your personal information after your death. You have the right to designate a person who will give us instructions concerning your personal information, including a request for its deletion, in the event of your death.
  

You also have the right to lodge a complaint with the data protection authority in your country of residence. You can find your national data protection authority online on the European Commission's institutional website.

You can exercise these rights by contacting our Privacy Officer as described in the HOW TO CONTACT US section at the beginning of this Policy. Please note that any request to stop the processing of your personal information or to have it deleted will not apply when BRP is obligated to contact you regarding health or safety matters, such as a safety recall or warranty issues concerning your BRP product(s), or when permitted by applicable law.

This section supplements the information contained in our Privacy Policy and applies only to customers, visitors, users and other persons residing in China.

Unless otherwise stated, the following BRP entities are considered data controllers under applicable laws, as each determines how and why it processes your personal information:

• Bombardier Recreational Products Inc., whose head office is located at 26 rue Saint-Joseph, Valcourt, Quebec J0E 2L0, Canada;
• BRP Commerce & Trade (Shanghai) Co Ltd. (Rm 301, Building 6, No.10 Heng Shan Rd, Xuhui District, Shanghai 200031, China).

BRP's legal basis for processing your personal information

BRP will process your personal information based on the following legal justifications:

• Your consent has been obtained;
• The processing is necessary for entering into or performing a contract with you;
• The processing is necessary for the performance of legal tasks or compliance with a legal obligation;
• The treatment is necessary to deal with public health emergencies or to protect the life, health and safety of property of a natural person;
• The information has been publicly disclosed by you or other personal information legally disclosed within a reasonable framework;
• Other circumstances provided for by laws and administrative regulations.
  

Rights relating to your personal information

In addition to the rights relating to your personal information described in the section YOUR RIGHTS RELATING TO YOUR PERSONAL INFORMATION , you have other rights relating to your personal information, such as:

• Right to information. You have the right to receive clear, transparent and easily accessible information on how your personal information is processed by BRP.
• You have the right to ask us to limit or stop the processing of your personal information. You can ask BRP to limit or refuse the processing of your personal information, unless otherwise required by law or administrative regulations.
• Right to withdraw your consent. If you have already given us your consent, you can withdraw it at any time.
• Right to request the erasure of your personal information . You have the right to request the erasure of your personal information when the conditions provided for by applicable law are met.
• Right to request the portability of your personal information. As part of your right to obtain a copy of your personal information, you may request that your personal information be transferred to a personal information manager you designate, provided that the manager meets the conditions of applicable law and BRP is required to provide a means of transfer.
• Right not to be subject to automated decision-making. When BRP makes push deliveries or commercial sales to you through automated decision-making, you have the right to request that we give you the option of not targeting your characteristics or provide you with a convenient method to opt out. Where the use of automated decision-making results in decisions that have a significant impact on your rights and interests, you have the right to demand an explanation from BRP and you have the right to refuse to have BRP make decisions solely using automated decision-making methods.
  

International transfers of personal information

When we share your personal information with third parties in accordance with this Privacy Policy, it may be transferred outside of China. We will always assess our legal justification for such a transfer and implement safeguards, as detailed in the section WHO WE SHARE YOUR PERSONAL INFORMATION WITH . We will transfer your personal information in compliance with applicable privacy laws and implement appropriate safeguards.