Privacy Policy

This Privacy Policy explains how Karida ("Karida," "we," "our," or "us") collects, uses, discloses, stores, and protects the personal information of users ("you") of the Karida mobile application and website (the "App" or "Platform"), a super app providing ride-hailing, food and grocery delivery, errands, rentals, and professional service bookings in the Philippines. This Privacy Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the E-Commerce Act (Republic Act No. 8792), and the Consumer Act of the Philippines (Republic Act No. 7394). By creating an account, downloading, installing, or using the Karida App, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Privacy Policy, please do not use the App.

We collect information that you provide directly and information collected automatically when you use the App. A. Information you provide: • Account information — full name, email address, mobile number, and password (encrypted). • Profile details — profile photo (passengers), residential or business address. • Driver information — permanent address, national ID number and image, driver's license number and image, vehicle details (type, model, plate number, vehicle photo). • Merchant information — business name, business address, contact number, TIN, mayor/barangay permit image, government ID, store photos, and staff details. • Payment information — GCash reference numbers, bank transfer references, and payment proof screenshots. We do not store full credit/debit card numbers; card processing is handled by certified third-party payment processors. • Communications — messages between passengers and drivers, customer notes to merchants, and reports you submit (incidents, SOS alerts). B. Information collected automatically: • Location data — GPS coordinates collected while the App is in use (during booking, active trips, deliveries, and driver availability) to enable matching, live tracking, and safety features. • Device and usage data — device model, operating system, app version, unique device identifiers, IP address, and interaction logs. • Camera and file access — used only with your permission for uploading profile photos, ID documents, product images, and payment proofs.

We process your personal information for the following purposes: • To create and manage your account and authenticate your identity. • To connect passengers with drivers, customers with merchants, and users with service providers. • To calculate fares, process payments, generate invoices, and maintain transaction records. • To provide real-time GPS tracking of rides and deliveries. • To verify drivers and merchants for platform safety and regulatory compliance. • To deliver customer support, resolve disputes, and handle refunds. • To send service notifications, booking updates, and important account alerts. • To enforce our Terms & Conditions and prevent fraud, abuse, and illegal activity. • To improve, secure, and optimize the App, and to develop new features. • To comply with legal, tax, and regulatory obligations under Philippine law. We do not sell your personal data to any third party.

Under the Data Privacy Act of 2012, we process your personal data on the following lawful bases: • Consent — you provide your personal information voluntarily when registering and using the App. • Contractual necessity — processing is required to deliver the services you requested (rides, orders, deliveries). • Legal obligation — we process data to comply with Philippine laws, tax requirements, and regulatory authorities. • Legitimate interest — to ensure platform security, prevent fraud, and protect the safety of all users. • Vital interest — location and SOS data may be shared with emergency services in genuine emergencies. You may withdraw your consent at any time by contacting us; however, withdrawal does not affect the lawfulness of processing already conducted.

We share your personal information only as necessary to provide our services and as permitted by law: A. Between users: Drivers see passenger pickup and drop-off locations and contact numbers during an active trip. Merchants see customer names, contact numbers, and delivery addresses for fulfilling orders. This information is limited to what is necessary for the transaction. B. Service providers and partners: We share data with trusted third parties that support our operations, including: • Open-source geocoding and routing services (OpenStreetMap/Nominatim/OSRM) and WhatsApp for live navigation coordination. • Payment processors (GCash, banks, and card networks). • Cloud hosting and data storage providers. • Email and notification delivery services. C. Government and law enforcement: We may disclose information to Philippine government agencies, law enforcement, or courts when required by law, court order, or to respond to safety threats, fraud, or criminal activity. D. Business transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred subject to the protections in this Privacy Policy. All third parties processing data on our behalf are bound by confidentiality and data protection obligations consistent with the Data Privacy Act.

Karida integrates with the following third-party services, each governed by its own terms and privacy policy: A. Open-source mapping services: Karida uses open-source geocoding and routing services (OpenStreetMap/Nominatim/OSRM) to convert addresses to coordinates and estimate travel distances. These services are governed by their own terms (OpenStreetMap is licensed under the Open Data Commons Open Database License). No proprietary map SDK is embedded in the App, and we do not scrape, cache, or build a private database from map content. B. WhatsApp: For real-time navigation during trips and deliveries, Karida shares your live GPS coordinates and trip details via WhatsApp so you and the other party can coordinate directly. Your use of WhatsApp is governed by its own terms of service and privacy policy. C. Payment providers (GCash, banks, card networks): Process payment transactions securely. We only store reference numbers and proof screenshots; sensitive card data is handled directly by the payment processor. D. Telecommunications and notification providers: Used to deliver SMS, email, and push notifications. We encourage you to review the privacy policies of these third-party services.

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy and to comply with legal, accounting, and regulatory requirements. • Active account data is retained while your account is active. • Transaction and invoice records are retained for at least five (5) years to comply with Philippine tax and accounting regulations (BIR requirements). • Identity verification documents (IDs, licenses, permits) are retained for the duration of your partnership with Karida and a reasonable period thereafter for audit and dispute purposes. • Location data is retained only for the duration necessary to provide the service and for a limited period for safety and dispute resolution. • Inactive accounts: Accounts inactive for more than 24 months may be anonymized or deleted, subject to legal retention obligations. You may request deletion of your account and associated personal data at any time, subject to legal retention requirements.

We implement industry-standard technical, organizational, and physical security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction: • Encryption of passwords and sensitive data in transit and at rest. • Role-based access controls limiting data access to authorized personnel only. • Secure authentication and session management. • Regular security reviews and monitoring for fraudulent activity. • Staff training on data privacy and the Data Privacy Act. Despite these measures, no system can be guaranteed 100% secure. In the event of a personal data breach, we will notify affected users and the National Privacy Commission in accordance with the Data Privacy Act and its Implementing Rules.

Under the Data Privacy Act of 2012, you have the following rights: • Right to be informed — to be informed about the processing of your personal data. • Right to access — to obtain a copy of your personal data held by us. • Right to object — to object to the processing of your personal data, including direct marketing. • Right to erasure or blocking — to have inaccurate, incomplete, or unlawfully obtained data corrected, blocked, or deleted. • Right to data portability — to obtain a copy of your data in a structured, commonly used format. • Right to rectify — to correct any inaccurate personal data. • Right to damages — to claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully processed data. To exercise any of these rights, contact our Data Protection Officer at karidasuperapp@gmail.com with the subject line "Data Privacy Request." We will respond within a reasonable period, not exceeding thirty (30) days.

The Karida App is not directed to, nor intended for use by, individuals under eighteen (18) years of age. We do not knowingly collect personal information from children. Drivers and merchants must be at least eighteen (18) years old and legally able to enter into contracts. Passengers under eighteen (18) may only use the service with the supervision and consent of a parent or legal guardian. If you believe we have collected personal data from a child, please contact us immediately so we can investigate and delete such information.

Karida uses local storage and similar technologies on your device to: • Keep you signed in and remember your session. • Remember preferences such as onboarding/tutorial completion. • Improve app performance and reliability. We do not use cookies or local storage for advertising or cross-site tracking. You can clear local storage at any time through your device or browser settings. Doing so may require you to sign in again and reset preferences.

Your personal data is primarily stored and processed within the Philippines. However, some of our service providers (such as cloud hosting and map providers) may process data in other countries. Where your data is transferred outside the Philippines, we ensure that: • The receiving country provides an adequate level of data protection, or • Appropriate safeguards are in place, such as contractual data protection clauses, and • The transfer is necessary to provide the services you requested. Your data continues to be protected in accordance with the Data Privacy Act regardless of where it is processed.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When material changes are made, we will: • Update the "Last Updated" date at the top of this document. • Notify active users via email or in-app notification. • Provide notice within the App before material changes take effect. Continued use of the App after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: Karida Platform Operations Data Protection Officer Email: karidasuperapp@gmail.com Address: Manila, Philippines For data privacy concerns specifically, please include "Data Privacy Request" in the subject line. You may also escalate data privacy concerns to the National Privacy Commission (NPC): Email: info@privacy.gov.ph Website: www.privacy.gov.ph We aim to respond to all privacy-related inquiries within thirty (30) days, in accordance with the Data Privacy Act of 2012.