Welcome To GOAIRA Privacy Policy

The privacy policy of “Apostophy Business Solutions Pvt Ltd” (collectively “GOAIRA”, “WE”, “OUR” or “US”), collect, use, disclose and protect the individual data about our customers, drivers, vendors and franchisee (collectively “YOU”, “YOUR” or “YOURS”) through the use of our GOIARA website and GOAIRA applications.

• A) COLLECTION OF PROTECTED INDIVIDUAL INFORMATION: Individual Data may be collected through the operations of our Apps, Websites and Services. We collect and combine the collected Individual Data with other Individual Data in our possession. If you have a party to multiple relationships with us (for example if you use our Services across our various business verticals, or if you are both a driver partner/delivery partner as well as a passenger on our transport vertical or a customer on our other business verticals), we will link your Individual Data collected across your various capacities to facilitate your use of our Services and for the Purposes described below. • While completing registration forms (such as your name, mobile number, email, Aadhar number, Pan number, address) • While providing information such as your driver’s license information, vehicle information and background check results (as legally permissible) • While filling up demographic information (such as your age, gender, and other information you may volunteer such as your marital status, occupation) • While booking we detect your location (pick-up locations) • while filling feedback and ratings • transaction information (such as payment method and distance travelled); • information about how you interacted with our Apps, Website or Services (such as features used and content viewed); • device information (such as hardware model and serial number, IP address, file names and versions and advertising identifiers or any information that may provide indication of device or app modification); • individual data you enter in messages when you use our in-app communication features; and • When we collect Individual Data, including but not limited to your name, contact information and other identification information where needed from other sources, we make sure that that data is transferred to us in accordance with applicable laws. Such sources include (our business partners, such as fleet partners, ride-hailing partners and transport partners) • marketing services providers or partners. • Individual Data about driver partners • If you are a driver partner, we may collect such as your speed, acceleration, and braking data) • device data (such as accelerometer data, GPS location, your IMEI number and the names of apps you have installed on your device); • Some sensitive Individual Data includes (including financial and criminal records, where legally permissible), health data, disability, marital status and biometric data, as applicable. We collect this information only with your consent and/or in strict compliance with applicable laws. • As a parent or legal guardian, please do not allow minors under your care to submit Individual Data to GOAIRA. • In the event that such Individual Data of a minor is disclosed to GOAIRA, you hereby consent to the processing of the minor’s Individual Data and accept and agree to be bound by this Policy and take responsibility for his or her actions. • When you provide Individual Data of other individuals to us (such as your spouse, family members or friends) for example, you may add them as your emergency contact. • If you provide us with their Individual Data, you represent and warrant that you have obtained their consent for their Individual Data to be collected, used and disclosed as set out in this Policy. In certain circumstances, you may need to provide your Individual Data in order to comply with legal requirements or contractual obligations, or where it is necessary to conclude a contract. Failure to provide such Individual Data, under such circumstance, may constitute failure to comply with legal requirements or contractual obligations, or inability to conclude a contract with you, as the case may be.

• B) PROVIDING INDIVIDUAL INFORMATION FOR FOLLOWING PURPOSES: Your Individual Data will be used to provide, individualize, maintain and improve our Apps, Websites and Services. • provide and engage you with Services across our various business verticals; • create, manage and update your account; • conduct due diligence checks; • verify your identity and age (where necessary); • validate your ride and process payments; • track the progress of your trip and detect abnormal trip variations; • enable features that individualize your App, such as lists of your favorite places and previous destinations; • make your experience more seamless, such as automatically filling in your registration information (such as your name or phone number) from one Service to another Service or when you participate in our surveys; • perform internal operations necessary to provide our Services, including troubleshooting software bugs and operational problems, conducting data analysis, testing and research, monitoring and analyzing usage and activity trends; • protect the security or integrity of the Services and any facilities or equipment used to make the Services available; • process and manage your rewards; • enable communications between our users; • process, manage or verify your application of promotions, rewards and subscriptions with GOAIRA; • enable our partners to manage and allocate fleet resources; and fulfil the services to you as a data processor, where you have provided consent to the data controller (i.e. the organisation you had purchased goods or services from, and for whom GOAIRA is providing services on behalf of) for such services to be rendered. • We use your data to ensure the safety and security of our Services and all users (screening driver and delivery partners before enabling their use of our Services); • identifying unsafe driving behaviour such as speeding, harsh braking and acceleration, and providing individualised feedback to driver partners; • verifying your identity when you log in to GOAIRA; • using device, location, profile, usage and other Individual Data to prevent, detect and combat fraud or unsafe activities; • sharing drivers and passengers’ location and details when the emergency button or the “Share My Ride” feature is activated; • monitoring compliance with our terms and conditions, policies and Driver’s Code of Conduct; and detecting, preventing and prosecuting crime. • We use Individual Data to resolve customer support issues like investigate and address concerns; • monitor and improve our customer support responses; • respond to questions, comments and feedback; and • inform you about steps taken to resolve customer support issues. • we collect for testing, research, analysis and product development. • This allows us to understand and analyse your needs and preferences, protect your Individual Data, improve and enhance the safety and security of our Services, develop new features, products and services, and facilitate insurance and finance solutions. • We may use when we are required, advised, recommended, expected or requested to do so by our legal advisors or any local or foreign legal, regulatory, governmental or other authority. • For example, comply with court orders or other legal, governmental or regulatory requirements; • enforce our Terms of Service or other agreements; and • protect our rights or property in the event of a claim or dispute. • We may use your Individual Data in connection with mergers, acquisitions, joint ventures, sale of company assets, consolidation, restructuring, financing, business asset transactions, or acquisition of all or part of our business by another company. • We may use for marketing GOAIRA and GOAIRA’s partners’, sponsors’ and advertisers’ products, services, events or promotions. • While sending you alerts, newsletters, updates, mailers, promotional materials, special privileges, festive greetings; and • also notify, invite and manage your participation in our events or activities. • We may communicate such marketing to you by post, telephone call, short message service, online messaging service, push notification by hand and by email. • If you wish to unsubscribe to the processing of your Individual Data for marketing and promotions, please click on the unsubscribe link in the relevant email or message. Alternatively, you may also update your preferences in our App settings.

• C) SHARING INDIVIDUAL INFORMATION WITH THIRD PARTIES: We need to share your Individual Data with third parties for the following purpose described below: • If you are a passenger, we may share your pick-up and drop-off locations with our driver partner fulfilling your service request. • If you are a driver partner, we may share your Individual Data with your passenger including your name and photo; your vehicle make, model, registration number, location and average rating. • If you are a delivery partner, we may share your Individual Data with your selected merchant and user, including your name and photo; your vehicle make, model, location and average rating. • If you use our in-app chat service, we may share your mobile number and GOAIRA-registered name with the other parties to your chat. • we may share a vehicle’s location and driver’s and/or passenger’s name with third parties when a passenger uses the “Share My Ride” feature or activates the Emergency Button. • If your employer may receive trip data when you use your employer’s GOAIRA for Business account. • we may share with our subsidiaries and franchisee. • We may share to our vendors, consultants, marketing partners, research firms, and other service providers or business partners. • We may share with cloud storage providers and data analytics providers; • with marketing partners and marketing platform providers; • with the fleet and merchant partners; insurance and financing partners; • We service providers who perform identity verification services; and • vehicle solutions partners, vendors or third-party vehicle suppliers. • With our legal advisors and governmental authorities where it is necessary to respond to an emergency that threatens the life, health or safety of a person; or • where it is necessary in the public interest (e.g. in a public health crisis, for contact tracing purposes and safeguarding our community).

• D) RETENTION OF INDIVIDUAL INFORMATION: We retain your Individual Data for the period necessary to fulfill the Purposes outlined in this Policy unless a longer retention period is required or allowed by law. Once your Individual Data is no longer necessary for the Services or Purposes, or we no longer have a legal or business purpose for retaining your Individual Data, we take steps to erase, destroy, or prevent access or use of such Individual Data for any purpose other than compliance with this Policy, or for purposes of safety, security, fraud prevention and detection, in accordance with the requirements of applicable laws.

• E) COOKIES AND ADVERTISING ON THIRD PARTY PLATFORMS: GOAIRA, and third parties with whom we partner, may use cookies, web beacons, tags, scripts, local shared objects such as HTML5 and Flash (sometimes called “flash cookies”), advertising identifiers (including mobile identifiers such as Apple’s IDFA or Google’s Advertising ID) and similar technology (“Cookies”) in connection with your use of the Websites and Apps. Cookies may have unique identifiers, and reside, among other places, on your computer or mobile device, in emails we send to you, and on our web pages. Cookies may transmit Individual Data about you and your use of the Service, such as your browser type, search preferences, IP address, data relating to advertisements that have been displayed to you or that you have clicked on, and the date and time of your use. Cookies may be persistent or stored only during an individual session. GOAIRA may allow third parties to use Cookies on the Websites and Apps to collect the same type of Individual Data for the same purposes GOAIRA does for itself. Third parties may be able to associate the Individual Data they collect with other Individual Data they have about you from other sources. We do not necessarily have access to or control over the Cookies they use. Additionally, we may share non-individually identifiable Individual Data with third parties, such as location data, advertising identifiers, or a cryptographic hash of a common account identifier (such as an email address), to facilitate the display of targeted advertising on third party platforms. If you do not wish for your Individual Data to be collected via Cookies on the Websites, you may deactivate cookies by adjusting your internet browser settings to disable, block or deactivate cookies, by deleting your browsing history and clearing the cache from your internet browser. You may also limit our sharing of some of this Individual Data through your App (Settings > Privacy > Ads) and mobile device settings.

• F) PROTECTION OF INDIVIDUAL INFORMATION: We will take reasonable legal, organizational and technical measures to ensure that your Individual Data is protected. This includes measures to prevent Individual Data from getting lost, or used or accessed in an unauthorized way. We limit access to your Individual Data to our employees on a need-to-know basis. Those processing your Individual Data will only do so in an authorized manner and are required to treat your information with confidentiality. Nevertheless, please understand that the transmission of information via the internet is not completely secure. Although we will do our best to protect your Individual Data, we cannot guarantee the security of your Individual Data transmitted through any online means, therefore, any transmission remains at your own risk.

• G) YOUR RIGHTS WITH RESPECT TO YOUR INDIVIDUAL INFORMATION: In accordance with applicable laws and regulations, you may be entitled to: • ask us about the processing of your Individual Data, including to be provided with a copy of your Individual Data; • request the correction and/or (in some cases) deletion of your Individual Data; • in some cases, request the restriction of the processing of your Individual Data, or object to that processing; • withdraw your consent to the processing of your Individual Data (where we are processing your Individual Data based on your consent); • request receipt or transmission to another organization, in a machine-readable form, of the Individual Data that you have provided to us where we are using your Individual Data based on consent or performance of a contract; and • complain to the relevant data privacy authority if your data privacy rights are violated, or if you have suffered as a result of unlawful processing of your Individual Data. Where you are given the option to share your Individual Data with us, you can always choose not to do so. If we have requested your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. However, choosing not to share your Individual Data with us or withdrawing your consent to our use of it could mean that we are unable to perform the actions necessary to achieve the purposes of processing described in Section II (Use of Individual Data) or that you are unable to make use of the Services. After you have chosen to withdraw your consent, we may be able to continue to process your Individual Data to the extent required or otherwise permitted by applicable laws and regulations. If you wish to make a request to exercise your rights, you can contact us through our contact details set out in Section X (How to Contact Us) below. We will screen and verify all requests beforehand. In order to verify your authority to make the request, we may require you to provide supporting information or documentation to corroborate the request. Once verified, we will give effect to your request within the timelines prescribed by applicable laws.

• H) AMENDMENTS AND UPDATES: GOAIRA shall have the right to modify, update or amend the terms of this Policy at any time by placing the updated Policy on the Websites. By continuing to use the Apps, Websites or Services, purchase products from GOAIRA or continuing to communicate or engage with GOAIRA following the modifications, updates or amendments to this Policy, you signify your acceptance of such modifications, updates or amendments.

• I) POSTSCRIPT: i) CLARIFICATION - All capitalised terms but undefined terms used herein shall bear the same meaning as those defined in the Terms of Use and the GOAIRA Privacy Policy (accessible at https://www.goaira.com/privacy/). This postscript forms part of the GOAIRA Privacy Policy. In the event of any inconsistency between the GOAIRA Privacy Policy and this postscript, this postscript shall prevail. ii) ASSOCIATION WITH USERS AND CLIENTS - We provide as an add-on feature to facilitate corporate billing for the Authorised Users’ use of GOAIRA’s Services in the course of work. When an organisation (“Client”) chooses to utilise GOAIRA for Business, the Authorised User is given the option of tagging his/her rides or other transactions to the Client or to tag it as a individual ride. An Authorised User is referred to in the GOAIRA Privacy Policy as a passenger. As part of this feature, GOAIRA will disclose detailed trip and booking information that Authorised Users have tagged as being for business purposes to the Client. Apart from this, GOAIRA does not disclose other Individual Data of its Authorised Users to the Client. Alternatively, an individual user may choose to set up a business profile within the App to facilitate the tagging of business-related rides and to generate consolidated trip reports to facilitate the submission of claims from his or her employer. When used in this mode, the claims process is user-driven and the user’s employer need not be a Client. For ease of reference, Authorised Users and individual users will each be referred to as a “User” and collectively as “Users” in this postscript. We data controller, so are our Clients in respect of any User and the processing of all their Individual Data (including but not limited to Linking Data and Portal Data), GOAIRA acts as a data controller. For further information on how GOAIRA collects, uses and discloses Users’ Individual Data, please refer to the GOAIRA Privacy Policy. Due to the way our Business works, we does not process any Individual Data for and on behalf of the Client. Accordingly, GOAIRA is not the data processor of the Client, but an independent data controller in respect of all Individual Data that it processes in the course of providing the GOAIRA for Business feature. Likewise, the Client is an independent data controller of the Individual Data (e.g. the Linking Data and Portal Data) that it discloses to and/or receives from GOAIRA. As independent controllers, GOAIRA and the Client individually determine the purposes and means of processing Individual Data, subject to the provisions set out in the Terms of Use and this Privacy Policy. GOAIRA and the Client are also individually responsible to ensure the protection of Individual Data under their charge. iii) WHAT INDIVIDUAL DATA IS COLLECTED, PROCESSED AND DISCLOSED We collect as a part of GOAIRA for Business in order to provide the GOAIRA for Business feature, the individual user or the Client will be required to provide the following information about the Authorised User to GOAIRA: • full name; • business email address; and • other identifying information about the authorised user as reasonably requested by GOAIRA. • GOAIRA will use this information for the purposes of authenticating the User; • where applicable, linking the Authorised User’s account with the Client’s GOAIRA for Business account or tracking the Authorised User’s business profile bookings on the Apps, as the case may be; • where applicable, verifying the Corporate Billing status of such Authorised User from time to time; and • contacting the User in accordance with the purposes set out in the GOAIRA Privacy Policy. • Upon onboarding such User to the App, GOAIRA will process the Individual Data of the User in accordance with the GOAIRA Privacy Policy and this postscript. iv) What GOAIRA discloses to its Clients We will disclose relevant trip and booking information as determined by GOAIRA from time to time to the Client to facilitate Corporate Billing. v) What GOAIRA discloses to its individual user Depending on the business profile settings selected by the individual user, the user may retrieve and generate reports containing his/her relevant trip and booking information. vi) PARTIES’ OBLIGATIONS The Client and GOAIRA shall each: individually inform their data subjects of how each processes Individual Data and allow their data subjects to exercise their rights under the local data protection/data privacy laws; comply with the obligations applicable to each party under the applicable data protection/data privacy laws when processing any Individual Data of the Proposed or Authorized Users; obtain the necessary consents (if applicable) to facilitate the provision of the GOAIRA for Business feature; and implement appropriate legal, technical and organizational measures to protect Individual Data against unauthorized or unlawful processing and against unauthorized loss, destruction, damage, alteration, or disclosure, as well as any breach or attempted breach of each party’s security measures (“Information Security Incident”).

• J) CHANGES TO THE PRIVACY POLICY: From time to time, we may update this Privacy Policy to reflect changes to our information practices. Any changes will be effective immediately upon the posting of the revised Privacy Policy.