ROBILE PRIVACY POLICY

Last Updated: 16/07/2021

By entering into this Agreement, you acknowledge and agree to the terms of this Privacy Policy and that this Privacy Policy forms part of the Agreement between you and us.

This Privacy Policy describes how we collect, use, disclose, retain, dispose of, and protect personal information in the course of providing services to you. Our Privacy Policy has been designed to comply with Canada’s Personal Information Protection and Electronic Documents Act, the Act Respecting the Protection of Personal Information in the Private Sector and other applicable privacy laws relating to the protection of personal information (collectively, “Privacy Legislation”).

We are committed to protecting your personal information. We have established practices and procedures to ensure that this information is appropriately safeguarded.

By accessing our services, you accept the terms of this Privacy Policy and consent to our collection, use, disclosure and retention of your personal information as described herein.

Our data processing practices may vary among the jurisdictions in which we operate in order to comply with applicable legal requirements. Please note that certain rights, requirements, and disclosures in this Privacy Policy may be subject to exemption or otherwise may not apply to you based, for example, on applicable law or regulations. If you reside in a relevant geographic location, please see the Region Specific Disclosures section for more information.

Collection of Personal Information

In this Privacy Policy, “personal information” or “personal data” means any information about an identifiable individual as defined in
applicable Privacy Legislation and includes information such as home address and telephone number, date of birth, age, and driver’s license.
It does not include business contact information of individuals that communicate with us in relation to their business, employment or
profession.We collect the following types of personal information:
Personal information that you give us:
- Identity Data. When you reserve the services, we require certain personal information, such as name, date of birth, street addresses,
  phone numbers, driver’s license number, date of issuance and issuing country and/or province and/or state, driving record, insurance
  information, and other forms of personal information.
- Payment data. When you make a reservation, we collect your digital payment details, and payment card number, which may be processed
  and stored by one or more third party payment service providers or digital payments companies.
- Communications. When you communicate with us, we may collect information about your communication and any information you choose to
  provide.
Personal information we automatically collect
- Usage data. We may collect information about your interactions with the services, such as your searches, bookings, navigation paths
  between pages, information about your activity on a page or screen, access time and duration, and other actions relating to the
  services.
- Location data. When you use certain features of the services, we may collect information about your approximate location. When you opt
  in to use our location sharing feature, we may collect the precise location information of your mobile device.
- Device data. We may collect information about your device, such as its manufacturer and model, browser type, screen resolution, IP
  address, and unique device identifiers.
- Trip data. We may collect information related to the trips you take using the services.
- In-vehicle device data. We may collect certain information from the in-vehicle computer, which may include, GPS location, car battery
  voltage, odometer reading, malfunction indicator lamp (e.g., a check engine light), speed, door state (e.g., locked/unlocked), and
  engine state (e.g., stopped/running).
- Cookies and similar technology. We (including companies we work with) may place small data files on your computer or other device you
  use to reserve the services. These data files may be cookies and other local storage provided by your browser or associated
  applications.
Personal information we collect from third-party sources.
- Third-party services. If you choose to log in to our services through a third-party site or service, the third-party service provider
  may send us your profile information from that provider. You agree that we may collect, store, and use this information provided by
  third-party service providers in accordance with this Privacy Policy.
- Background check services. To the extent permitted by applicable laws, we may use your personal information to collect background
  information about you from public records, background check providers, other screening services and other third-party data providers.
Use of Personal Information

We will use, store, and process your personal information for the following reasons and purposes:
- To provide and improve the services and for security and safety purposes. For example, we may use your information to provide the
  services, including to provide you with customer support, send you administrative messages, reminders, technical notices, updates,
  security alerts, and information requested by you, facilitate your login to your Robile account using third-party identity and access
  management providers, process transactions and send notices about your transactions, customize your user experience; manage your
  referral invitations, rewards, etc., and send you requests for reviews, for fraud detection and prevention, and for any other purpose
  you authorize at the time of collection.
- For research and development. For example, we may use your personal information to analyze and improve the services and to develop new
  services. We may also use your personal information to create aggregated or other anonymized data, which we may share with third
  parties for any lawful business purposes.
- For direct marketing and advertising to you and interest based advertising.
- For security and safety. For example, we may use your personal information to authenticate any information that you provide us,
  collect fees, detect, prevent, and/or remediate fraud, abuse, security incidents, or other violations of this Agreement, to identify
  unsafe driving behavior, and to conduct investigations and risk assessments.
- To comply with law. For example, we may use your personal information as we reasonably believe is appropriate in order for us to
  comply with applicable laws, lawful requests, and legal processes.
- With your consent. We may use your personal information if you consent to such use.
Disclosure of Personal Information

We will disclose your personal information to the following groups:
- Service providers. We may share personal information with service providers who support the operation of the services or who need
  access to such information for bona fide business purposes.
- Professional advisors. We may disclose personal information to our professional advisors where necessary in the course of the
  professional services that they render to us.
- Business transfers. We may transfer or license your personal information in connection with a business transaction (or potential
  business transaction) such as a license, corporate divestiture, merger, acquisition, reorganization, or sale of assets, or in the
  event of bankruptcy or dissolution.
- Legal Requests. We may disclose your personal information to courts, law enforcement, governmental or tax authorities, or third
  parties, if we reasonably believe that disclosure is appropriate in order for us to comply with applicable laws, lawful requests, and
  legal processes
As noted above, certain vehicle information such as location, speed and distance travelled is collected by, and transmitted to, the car
manufacturer. Such vehicle information is processed in accordance with the car manufacturer’s privacy policy.
Security

We employ a number of technical, physical, and organizational measures designed to protect personal information against unauthorized access,
destruction, or alteration while it is under our control. However, no method of transmitting or storing information can be 100% secure and we
cannot guarantee the security of your personal information.
Where We Store Personal Information

The services are controlled and operated from Canada and the personal information we collect from you will be used, stored, and processed in
Canada. Please note that certain vehicle information is collected by the vehicle manufacturer and may be stored outside Canada. This
information is subject to the laws of the third party’s jurisdiction, including laws with respect to disclosure of such information, and may
be accessible by regulatory authorities in other jurisdictions.
How We Obtain Your Consent To The Collection, Use And Disclosure Of Your Personal Information

By using our websites, purchasing our services and continuing to do business with us, you are consenting to the collection, use and disclosure
of your personal information for the purposes identified in this Privacy Policy. We will not, as a condition to the supply of services,
require you to consent to the collection, use or disclosure of your personal information beyond that required to fulfill those purposes.
Withdrawing your Consent

You may withdraw all or part of your consent for us to collect, use or disclose your personal information in accordance with this Privacy
Policy at any time upon reasonable notice to us in writing, subject to legal or contractual restrictions. The withdrawal of your consent may
affect our ability to continue to provide you with the services that you have or would like to receive.
If you have previously agreed to receive promotional emails from us, you may also opt out of receiving promotional emails from us by following
the instructions in those emails. If you opt out, we may still send you non-promotional communications, such as messages about your account or
our ongoing business relations.
Retaining and Disposing Of Information

Your personal information is maintained on our networks or on the networks of our service providers and car manufacturers. Your information
may also be stored by us or on behalf of us in a secure off-site storage facility. To satisfy regulatory requirements, we will retain personal
information for at least seven years (unless there are legal requirements that require its further retention) after which all documentation
will be destroyed in a manner commensurate with its sensitivity.
Disclosure of Personal Information

We will disclose your personal information to the following groups:

Access to Personal Information

You may request a copy of your personal information from us pursuant to any information access rights that you may have under applicable law.
Should we receive such a request, we may request proof of your identity in order to verify your access request.
Sensitive information

We ask that you do not disclose to us any sensitive information (such as social insurance numbers, passports, information related to racial or
ethnic origin, or health) unless specifically requested by us.
Responding To Inquiries And Complaints

If you have questions or complaints with respect to our privacy policies and practices or if you wish to request access to, or correction of,
your personal information under our care and control, please contact the Privacy Officer at:
[Insert Address, email address and a phone number]
Inquiries or complaints will be dealt with promptly. The Privacy Officer will acknowledge your query, investigate and provide you with a
response within 30 days.
Right To File A Complaint

If you believe the privacy laws relating to the protection of your personal information or our Privacy Policy have not been respected, you may
file a complaint with our Privacy Officer at the address listed above. We will investigate all complaints. If, after an investigation, your
complaint is deemed justified, we will take appropriate steps to correct the situation, including, if necessary, amending our policies and
practices. If you are not satisfied with the results of the investigation or the corrective measures taken by us, you may exercise the
remedies available under law by contacting the Office of the Privacy Commissioner of Canada at the address below:
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, QC K1A 1H3
Changes To Our Privacy Policy

Subject to applicable law, we reserve the right to modify or supplement this Privacy Policy at any time. If we make changes, we will notify
you by posting the updated policy and revising the “Last Updated” date. We encourage you to review this Privacy Policy whenever you use our
services and to stay informed about our information practices and how you can help protect your privacy.
Region Specific Disclosures
- United Kingdom
  
  Notice to Individuals in the United Kingdom, a member state of the European Union or the European Economic Area
  Our legal bases for processing personal information are:
  - To comply with legal obligations;
  - To perform contracts;
  - To pursue our legitimate interests, including, engaging in commerce, offering the services, preventing fraud, correcting and
    addressing technical, service or security problems, ensuring information and network security, direct marketing and
    advertising, and complying with industry practices; and
  Data Retention
  
  We retain personal information pursuant to our records retention program, for as long as is necessary for the purposes set out in this
  Privacy
  Policy, unless a longer period is permitted or required under applicable law or is needed to resolve disputes or protect our legal
  rights. We
  may retain anonymized, aggregated data indefinitely, to the extent permitted under applicable law.
  The criteria used to determine the period for which personal information about you will be stored varies depending on the legal basis
  under
  which we process such personal information:
  - Legitimate Interests. For a reasonable period of time based on the particular interest, taking into account the fundamental
    interests
    and the rights and freedoms of the data subjects.
  - Contractual Necessity. For the duration of the contract plus some additional limited period of time that is necessary to
    comply with
    law or that represents the limitation period for legal claims that could arise from the contractual relationship.
  - Legal Obligation. For the duration of time we are legally obligated to keep the information.
  - Consent. For the period of time necessary to fulfill the underlying agreement with you, subject to your right, under certain
    circumstances, to have certain personal information about you erased (see Data Subject Rights below).
  Automated Decisions
  
  To the extent permitted by applicable law, we may collect data in an automated manner and make automated decisions, including using
  machine
  learning algorithms, about individual users of the services in order to provide or optimize the services offered and/or delivered, for
  security or analytics purposes, and for any other lawful purpose. To the extent permitted by applicable law, we may use automated
  decisions,
  for example, to display advertisements and offers based on the individual’s preferences.
  
  International Data Transfers
  
  The services may be provided using resources and servers located in various countries around the world, including Canada, the United
  States
  and other countries. Therefore, personal information about individuals or customers may be transferred, processed and stored outside
  the
  country where the services are used, where the level of data protection may not be deemed adequate by the European Commission. If you
  are
  located outside of these jurisdictions, the transfer of personal information may be necessary to provide you with the requested
  information,
  products, and services and/or to perform any requested transaction. By using any portion of the services, you acknowledge and consent
  to the
  transfer of your information as set forth herein.
  
  Data Subject Rights
  
  Under certain circumstances, under applicable data protection law you have the right to.
  - Access. Individuals have the right to know if we are processing personal information about them and, if so, to access and
    obtain a
    copy of personal information about them, as well as information relating to the processing of that data.
  - Rectification. Individuals have the right to have us correct or update any personal information about them that is inaccurate
    or
    incomplete without undue delay.
  - Restriction. Individuals have the right to restrict or limit the ways in which we process personal information about them
    where the
    accuracy of the personal information is contested by them, where data has been obtained by us unlawfully, where the individual
    has
    objected to our processing of the data (see right of objection below) and we are considering whether to cease processing, or
    where we
    no longer need to process the personal information.
  - Objection. Individuals have the right to object to our processing of their personal information where we are relying on
    legitimate
    interests as our legal basis and their rights override our legitimate interests in processing their personal information.
    Individuals
    also have the right to object to our processing of their personal information for direct marketing purposes.
  - Withdrawal of Consent. Where we rely on consent as the basis for processing personal information, individuals have the right
    to
    withdraw their consent.
  - Erasure. Individuals have the right to request deletion or erasure of their personal information in a number of circumstances
    where
    required by law. These include where we no longer require the personal information for the purposes for which it was
    collected, the
    individual has withdrawn consent or, where we are relying on legitimate interests as a legal basis, and the individual’s
    rights
    override our legitimate interests.
  - Portability. Individuals have the right to obtain a copy of the personal information we hold about you in a structured
    machine-readable format and to have it transmitted to another controller. This right only occurs where we are relying on your
    consent
    or performance of a contract as our legal basis and the processing is carried out automatically.
  - Make a Complaint. Individuals also have the right to make a complaint about our personal information handling practices to
    their local
    data protection authority. We would, however, appreciate the chance to deal with your concerns before you approach the data
    protection
    authority, so please contact us in the first instance.
  To assert one of your legal rights described in this Section, or if you have questions about this Section or our data handling
  practices,
  please contact us per the details provided below and provide sufficient details so that we can respond appropriately. We will process
  any
  requests in accordance with applicable law and within a reasonable period of time. We may need to verify the identity of the
  individual
  submitting a request before we can address such request. If the request relates to data our customers collect and process through the
  services, we will refer the request to that customer and will support them in responding to the request. For Robile customers, certain
  information may be reviewed, corrected and updated by logging into your online account and editing the profile information.
  
  Compelled Disclosures
  
  We may be required to disclose personal information in response to lawful requests by public authorities, including to meet national
  security or
  law enforcement requirements.
  
  Data Protection Contact
  
  Our Data Protection Contact for the personal information collected in connection with the services is:
- California Privacy Rights
  
  We do not sell personal information, or otherwise provide personal information to third parties, other than service providers
  receiving
  information to perform services for us on our behalf.
  We disclose the following categories of personal information for a business purpose:
  - Identifiers;
  - Commercial information;
  - Information relating to Internet activity or other electronic network activity;
  - Geolocation data;
  - Audio, electronic, or visual information;
  - Characteristics of protected classifications under California or federal law; and
  - Other information.

ROBILE PRIVACY POLICY

Collection of Personal Information

Use of Personal Information

Disclosure of Personal Information

Security

Where We Store Personal Information

How We Obtain Your Consent To The Collection, Use And Disclosure Of Your Personal Information

Withdrawing your Consent

Retaining and Disposing Of Information

Disclosure of Personal Information

Access to Personal Information

Sensitive information

Responding To Inquiries And Complaints

Right To File A Complaint

Changes To Our Privacy Policy

Region Specific Disclosures

United Kingdom

Data Retention

Automated Decisions

International Data Transfers

Data Subject Rights

Compelled Disclosures

Data Protection Contact

California Privacy Rights

Your Rights Under California Law

Shine the Light Law