dBlack Privacy Notice

Scope

This notice applies to users of dBlack's apps, websites, and other services globally.

This notice describes how dBlack and its affiliates collect and use data. This notice applies to all dBlack users globally, unless they use a service covered by a separate privacy notice specific to different countries, which shall be referenced exclusively in this section prior to the launch of dBlack platform into those countries.. This notice specifically applies to:

• Riders: those who request or receive transportation and related services, including package delivery and return services via their dBlack account.
• Drivers: those who provide transportation to Riders individually via their dBlack account or through partner transportation companies.
• Guest users: those without an dBlack account who receive ride and delivery services ordered by other dBlack account owners, including those who receive services arranged by dBlack for Business customers (collectively, “Enterprise Customers”); or by friends, family members or other individual account owners, including gift card recipients.
• Individual or Company Vehicle Owners: those who make their vehicle(s) available to other drivers to serve riders, either by individual or company ownership of the vehicles.

This notice also governs dBlack's other collections of data in connection with its services. For example, we may collect contact information of owners or employees of companies using dBlack platforms; contact information of those who manage and use accounts owned by Enterprise Customers; or data of those who start but do not complete their applications to be drivers and riders.

All those subject to this notice are referred to as “users” in this notice.

Our privacy practices are subject to applicable laws in the places in which we operate. This means that we engage in the practices described in this notice in a particular country or region only if permitted under the laws of those places.

In addition, please note the following:

• For users in the European Economic Area (“EEA”), United Kingdom (“UK”), and Switzerland: Due to data protection and other laws in these regions, including the European Union's General Data Protection Regulation (“GDPR”), dBlack does not perform certain of the data collections and uses described in this notice in the EEA, UK or Switzerland. Such data collections and uses are indicated herein with an asterisk (*).

The data we collect

dBlack collect following data:

1. provided by users to dBlack
2. created during the use of our services
3. from other sources

Following section explains the data that we collect and the process by which we collect those information.

1. Data Provided by Users to dBlack. This category includes:

1. Account information: We collect data when users create or update their dBlack accounts. This includes first and last name, email, phone number, gender (optional), login name and password, address, profile picture, emergency contact information, payment or banking information (including related payment verification information), user settings (including accessibility settings), and loyalty program information for dBlack partners.

   For drivers, this also includes vehicle or insurance information and evidence of health or fitness to provide services using dBlack apps.

2. Background check information (drivers): This includes information submitted during the driver/delivery person application process, such as driver history or criminal record (where permitted by law), licence status, known aliases, prior addresses, and right to work. This information may be collected by dBlack service providers.

3. Identity verification documents and photos: This includes government issued identification such as driver's licence or passports (which may contain identification photos and numbers, date of birth, and gender), and user-submitted photos such as selfies and profile pictures.

   For drivers, we also collect vehicle photos, vehicle registration information and other country specific necessary licensing information along with the photos for verification.

4. Demographic data: We collect demographic data such as birth date/age, gender or occupation when necessary to enable certain features, or provide access to age-restricted products or services.. We also collect or infer (using first name) gender information to enable female or non-binary users to designate their preference for providing or receiving services to/from female or non-binary users, as well as for marketing and advertising

   We also collect demographic data, such as age group and household composition, through user surveys.

5. User content: We collect data (including chat logs and call recordings) when users contact dBlack customer support, provide ratings or feedback for users, restaurants or merchants, use features that enable users to upload content or submit recordings (including in-app audio recordings or dashboard cameras recordings), or otherwise contact dBlack.

2. Data created during the use of our services. This category includes

1. Location data: We collect precise and approximate location data from drivers' and delivery persons' mobile devices when the dBlack app is running in the foreground (app open and on-screen) or background (app open but not on-screen). We collect precise and/or approximate location information from riders' and order recipients' mobile devices if they enable us to do so via their device settings. For a ride call to be successful i.e. for the drivers to locate the riders, initial location information of riders are collected during the time of initiating the ride request.

   dBlack collects such data from the time a ride or order is requested until it is finished, and any time the app is running in the foreground (app open and on-screen). See “Choice and transparency” below for information on how riders and order recipients can enable precise location data collection.

   Riders and order recipients may use the dBlack apps without enabling collection of location data from their mobile devices. However, this may affect certain features in the dBlack apps. For example, a rider who has not enabled precise location data will have to manually enter their pickup address.

   In addition, precise location data collected from a driver's device during a trip is linked to the rider's account, even if the rider has not enabled precise location data to be collected from their device. This data is used for purposes such as customer support, fraud detection, insurance, litigation and receipt generation.

2. Transaction information: We collect transaction information related to the use of our services, including the type of services requested or provided; trip or order details (such as date and time, requested pick-up and drop off addresses, distance travelled and items ordered, such as food, prescription drugs or other delivery items); and payment transaction information (such as a restaurant's or merchant's name and location, amount charged, and payment method). We also associate a user's name with that of anyone who uses their promotion code.

   This also includes information provided by users when placing their order, such as their allergies information.

3. Usage data: We collect data about how users interact with our services. This includes access dates and times, app features or pages viewed, browser type, and app crashes and other system activity.

4. Device data: We collect data about the devices used to access our services, including the hardware models, device IP address or other unique device identifiers, operating systems and versions, software, preferred languages, advertising identifiers, device motion data, and mobile network data.

5. Communications data: We collect data regarding communications between users that are enabled through dBlack's apps. This includes communication type (phone, text or in-app message), date/time, and content (including recordings of phone calls solely when users are notified of the recording in advance).

3. Data from other sources. This category includes

1. Users participating in our referral programs.

2. dBlack account owners who request services for or on behalf of other users (such as friends and family members).

3. Users providing information in connection with claims and disputes.

4. dBlack business partners through which users create or access their dBlack account, such as payment providers, social media services, or apps or websites that use dBlaks's APIs or whose APIs dBlack uses.

5. dBlack business partners in connection with debit or credit cards issued by a financial institution in partnership with dBlack to the extent disclosed in the terms and conditions for the card.

6. Service providers who help us verify users' identity, background information, and eligibility to work, detect fraud, and screen users in connection with sanctions, anti-money laundering, or know-your-customer requirements.

7. Insurance, vehicle, or financial services providers for drivers.

8. Partner transportation companies (for drivers or delivery persons who use our services through an account associated with such a company).

9. Publicly available sources.

10. Marketing partners and service providers, including banks in connection with cash back programs, and data resellers.

11. Law enforcement officials, public health officials, and other government authorities.

How we use data

dBlack uses data to enable reliable and convenient transportation, delivery, and other products and services. We also use data:

• to enhance the safety and security of our users and services
• for customer support
• for research and development
• to enable communications between users
• for marketing and advertising
• to send non-marketing communications to users
• in connection with legal proceedings

The data dBlack Platform collects are used:

1. To provide our services: At dBlack we use data to provide, personalise, maintain, and improve our services. This includes using data to:

   • Create/update accounts.
   • Enable transportation, delivery and other services/features, such as:
     • Using location data to navigate rider pick-ups and order drop-offs, calculate ETAs, and track the progress of rides or deliveries.
     • Enabling features that involve data sharing, such as sharing drivers' names and vehicle information with riders to facilitate pick-ups, or features that enable ETA sharing and fare splitting.
     • Matching available drivers and delivery persons to users requesting services, including based on personal data such as location and proximity to other users, and user settings / preferences (such as preferred destinations), and non-personal data such as vehicle type requested.
     • In some cases and/or in connection with programs such as dBlack Corporate or Ride Reservation, matches are also determined using cancellation rates, ratings and user behaviour information.
     • Enabling accessibility features.
     • Enabling features that involve account linking, such as linking with third party reward programs.
     • Calculating prices and fares, including using location data and trip or order details (such as requested pick-up and drop off addresses). We may also consider non-personal data or factors, including date and time, estimated distance and time, minimum base fares, tolls, taxes and fees, and surge pricing.
     • Facilitate insurance, vehicle, invoicing, or payment processing.
     • Provide users with trip or delivery updates, generate receipts, and inform them of changes to our terms, services, or policies. Perform necessary operations to maintain our services, including to troubleshoot software bugs and operational problems.

   dBlack performs the above activities on the grounds that they are necessary to fulfil the terms of our agreements with users, are compatible with such uses, or are necessary for purposes of dBlack's and its users' legitimate interests.

2. Safety, fraud protection and security: We use data to help maintain the safety, security, and integrity of our services and users. This includes:

   • Verifying users' accounts, identity or compliance with safety requirements. For example, we review driver and delivery person background checks (including criminal history where required or permitted by law) to verify their identities and eligibility to provide transportation or deliveries. We process and compare user profile pictures, government-issued identification photos and numbers, or other user-submitted photographs to perform this verification, including in some regions through use of facial recognition technology. We also use such technology to prevent fraudulent use of identification photos, or to prevent users from creating multiple accounts. We also may use facial recognition technology to prevent fraudulent use of dBlack accounts by those other than the account owner, which may occasionally or regularly ask drivers and delivery persons to take a selfie before they can go online and compare it with their profile pictures. We also may use a similar ID check feature to verify change of bank account information, and to facilitate regaining account access.
   • Using customer service information (including reports of safety incidents), device data (e.g., to detect speeding or harsh braking / acceleration), transaction, and usage data to identify potentially unsafe drivers and driving. This can lead to drivers and delivery persons receiving messages encouraging safer driving, and/or account deactivation following human review.
   • Using account, device, location, usage, transaction, wireless carrier, and other data, including communications between users and metadata, to prevent, detect, and combat fraud, including by guest users.
   • Using reported incidents, user ratings, and other feedback to encourage safe use of dBlack's platform and compliance with our terms and as grounds for deactivating users with low ratings.
   • Using driver data (such as past trip information and reported incident rates) and rider data (such as account information, cancellation and reported incident rates, current pick-up and drop-off location, past trip information, and ratings information) to predict and help avoid pairings of users that may result in increased risk of conflict. We may also avoid pairings where one user has previously given the other a low (e.g., 1 star) rating.
   • Using location, phone number, user name, vehicle details and other relevant information to provide live support from safety experts during trips or deliveries.

   The fraud and unsafe driving prevention and detection activities described above may be considered profiling under applicable laws, and can result in deactivation of users (generally only after human review).

   dBlack performs the above activities on the grounds that they are necessary to fulfil the terms of our agreements with users, and/or for purposes of the legitimate safety and security interests of dBlack, our users and members of the general public.

3. Customer Support: We use the information we collect (which may include call recordings, chat logs, in-app audio recordings and dashcam footage) to provide customer support, including to investigate and address user concerns and to monitor and improve our customer support responses and processes.

   dBlack performs the above activities on the grounds that they are necessary to fulfil the terms of our agreements with users or for purposes of dBlack's legitimate interests in monitoring and improving its customer support services.

4. Research and development: We use data for analysis, machine learning, product development, research, and testing. This helps us make our services more convenient and easy-to-use, enhance the safety and security of our services, and develop new services and features.

   dBlack performs the above activities on the grounds that they are necessary for purposes of dBlack's legitimate interests in improving and developing new services and features.

5. Enabling communications between users: We use data to enable chat and voice call between a rider and a driver, strictly related to an active ride. For example, a driver may message or call a rider to confirm a pick-up location, a rider may call a driver to retrieve a lost item, or a restaurant or delivery person may contact an order recipient with information about their order.

   dBlack performs the above activities on the grounds that they are necessary to fulfil the terms of our agreements with users.

6. Marketing and Advertising: dBlack uses data (other than guest users' data) to market its services, and those of dBlack partners.

   We specifically use account, approximate location, device and usage data, preferred language, and trip and order history to provide ads and marketing communications that are personalised based on users' observed or inferred location, interests and inferred characteristics.

   This includes using this data to:

   • Send emails, text messages, push notifications, and in-app messages or other communications marketing or advertising dBlack products, services, features, offers, promotions, sweepstakes, news and events. For example, we may send push notifications suggesting a user's favourite destinations or merchants, or in-app messages offering discounts or promo for products or merchants similar to those a user has previously ordered.
   • Display personalised advertising on third party apps or websites.
   • Display third party advertising in dBlack's apps or in connection with our services. For example, we display ads for restaurants or merchants that are available on dBlack's apps. These ads (which are identified as “Sponsored Listings” in dBlack's apps) include recommendations that are personalised based on users' location and order histories.

   We also display ads for third party products that are not available on dBlack's apps. These ads may contain links to third party apps or websites. Users should refer to such third parties' privacy notices for information on their collection and use of data when visiting such apps or websites.

   We also provide ads that are personalised based on data about users' current trip or delivery request, including time of request and services requested. For example, if a user requests a trip to a supermarket, we may display in-app ads for third party products that may be available at that supermarket.

   We also measure the effectiveness of dBlack's ads, and of third party ads displayed in dBlack's apps or in connection with our services.

   dBlack performs the above activities on the grounds that they are necessary for purposes of dBlack's legitimate interests in informing users about dBlack services and features or those offered by dBlack partners. When these marketing and advertising features are launched in different markets, the users of the platform will have the option to choose to opt in or out of such marketing and advertising messages via dBlack platform (Apps and/or Website).

7. Non-marketing communications: dBlack may use data to send surveys and other communications that are not for the purpose of marketing the services or products of dBlack or its partners. We may also send users communications regarding elections, ballots, referenda, and other political processes that relate to our services. For example, dBlack has notified users of ballot measures or pending legislation relating to dBlack's services in those users' areas.

   dBlack performs the above activities on the grounds that they are necessary to fulfil the terms of our agreements with users, or for purposes of dBlack's and its users' legitimate interests in informing users about events that may have an impact on their use of dBlack's services.

8. Legal proceedings and requirements: We use data to investigate or address claims or disputes relating to use of dBlack's services, to satisfy requirements under applicable laws, regulations, operating licences or agreements, insurance policies, or pursuant to legal process or governmental request, including from law enforcement.

   dBlack performs the above activities on the grounds that they are necessary for purposes of dBlack's legitimate interests in investigating and responding to claims and disputes relating to use of dBlack's services and features, and/or necessary for compliance with applicable legal requirements.

dBlack and Partner Cookies

Cookies are small text files that are stored on browsers or devices by websites, apps, online media, and ads. dBlack uses cookies and similar technologies for purposes such as:

• Authenticating users
• Remembering user preferences and settings
• Determining the popularity of content
• Delivering and measuring the effectiveness of advertising campaigns
• Analysing site traffic and trends, and generally understanding the online behaviours and interests of people who interact with our services

We may also allow others to provide audience measurement and analytics services for us, to serve ads on our behalf across the internet or for other companies' products and services on our apps, and to track and report on the performance of those ads. These entities may use cookies, web beacons, SDKs, and other technologies to identify the devices used by visitors to our websites, as well as when they visit other online sites and services.

Please see our Cookie Notice for more information regarding the use of cookies and other technologies described in this section.

Data sharing and disclosure

Some of dBlack's services and features require that we share data with other users, or at users' request or with their consent. We may also share such data with our affiliates, subsidiaries, and partners, for legal reasons or in connection with claims or disputes.

dBlack may share data:

1. With other users

   This includes sharing:

   • Riders' name, rating, profile photo and pickup and/or dropoff locations with drivers.

   • For drivers, we may share data with the riders including name and photo; vehicle make, model, colour, licence plate, and vehicle photo; location (before and during trip); average rating provided by users; total number of trips; period of time since they signed up to be a driver or delivery person; contact information; and driver or delivery person profile, including compliments and other feedback submitted by past users. For drivers and delivery persons who self-identify as deaf or hard of hearing via our in-app accessibility settings, we will share that information with the riders and order recipients.

     We also provide riders with receipts containing information such as a breakdown of amounts charged, driver or delivery person first name, photo, and route map. We also include other information on those receipts if required by law.

   • With an account owner when used by another person, such as when a rider uses their employer's dBlack for Business profile, a rider or order recipients uses an account linked to their family profile, a driver or delivery person uses an account owned by or associated with an dBlack partner transportation company.

     In addition, if a user creates an account using an email address affiliated with an dBlack for Business account owner (i.e., their employer), we may use, and share their profile data (such as name and email address) with such account owner, to help that user expense trips or orders to that dBlack for Business account.

   • For those who participate in dBlack's referral program, we share certain data of referred users, such as trip count, with the user who referred them as necessary to determine the referral bonus.

2. At users' request or with users' consent

   This includes sharing data with:

   • Other people at a user's request. For example, we share a user's ETA and location with a friend when requested by that user, or a user's trip information.

   • dBlack business partners. For example, if a user requests a service through a partnership or promotional offering made by a third party, dBlack may share certain data with those third parties.

   • Emergency services. We offer features that enable users to share their data with police, fire, and ambulance services in the event of an emergency or after certain incidents.

   • Insurance companies. If a user has reported or submits a claim to an insurance company relating to dBlack's services, dBlack will share certain data with that insurance company for the purpose of adjusting or handling the user's insurance claim.

   • General public. Questions or comments from users submitted through public forums such as dBlack blogs and dBlack social media pages may be viewable by the public, including any data included in the questions or comments submitted by a user.

3. With dBlack subsidiaries and affiliates

   We share data with our subsidiaries and affiliates to help us provide our services or conduct data processing on our behalf. Although the data is physically stored within the same country where our service is offered, the data can be viewed by our subsidiaries for operational purposes. For example, dBlack's contact centre personnel are located in Bangladesh who are able to support the issues raised by the users of dBlack platform.

4. With dBlack service providers and business partners

   These include the third parties, or categories of third parties, listed below. Where a third party is identified, please see their linked privacy notices for information regarding their collection and use of personal data.

   • Payment processors and facilitators, including PayPal and Stripe.

   • Background check, identity verification and risk solutions providers.

   • Cloud storage providers including AWS.

   • Customer support platform and service providers..

   • Google, in connection with the use of Google Maps in dBlack's apps.

   • Social media companies, including Facebook, Instagram and X (formerly Twitter), in connection with dBlack's use of their tools in dBlack's apps and websites.

   • Marketing partners and marketing platform providers, including social media advertising services, advertising networks, third-party data providers, and other service providers to reach or better understand our users and measure advertising effectiveness.

   • Research partners, including those performing surveys or research projects in partnership with dBlack or on dBlack's behalf.

   • Service providers that assist dBlack to enhance the safety and security of dBlack apps and services.

   • Service providers that provide us with artificial intelligence and machine learning tools and services.

   • Accountants, consultants, lawyers, and other professional service providers.

   • Insurance and financing partners.

   • Insurance companies, in connection with insurance claims made or reported by a user relating to dBlack's services, and for the purpose of adjusting or handling the insurance claim.

   • Airports.

5. For legal reasons or in the event of a dispute

   dBlack may share users' data if we believe it's required by applicable law, regulation, operating licence or agreement, legal process or governmental request, insurance policy, or where the disclosure is otherwise appropriate due to safety or similar concerns.

   This includes sharing data with law enforcement officials, public health officials, other government authorities, airports (if required by the airport authorities as a condition of operating on airport property), insurance companies, or other third parties as necessary to enforce our Terms of Service, user agreements, or other policies; to protect dBlack's rights or property or the rights, safety, or property of others; or in the event of a claim or dispute relating to the use of our services. In the event of a dispute relating to use of another person's credit card, we may be required by law to share a user's data, including trip or order information, with the owner of that credit card.

   This also includes sharing data with others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.

6. With consent

   dBlack may share a user's data other than as described in this notice if we notify the user and they consent to the sharing.

Data retention and deletion

dBlack retains user data for as long as necessary for the purposes described above. Users may request account deletion through the dBlack apps and websites.

The collected data varies depending on data type, the category of user to whom the data relates, the purposes for which we collected the data, and whether the data must be retained after an account deletion request for the purposes described below.

For example, we retain data:

• For the life of users' accounts if such data is necessary to provide our services. e.g., account data.
• For 7 years if necessary to comply with tax requirements. e.g., drivers' and delivery persons' trip or delivery location information. The retention period depends on the country's regulations where a driver operates in.
• For defined periods as necessary for purposes of safety or fraud prevention. e.g., we retain incomplete or rejected driver applications for 1 year.

Users may request deletion of their account through the Privacy menus in the dBlack app, or through dBlack's website.

Following an account deletion request, we delete the user's account and data, except as necessary for purposes of safety, security, fraud prevention or compliance with legal requirements, or because of issues relating to the user's account (such as an outstanding credit or an unresolved claim or dispute). For drivers and delivery persons, this generally means that we retain certain of their data for as long as necessary for actual or potential tax, litigation, or insurance claims. For rider and order recipients, we generally delete data within 90 days of an account deletion request, except where retention is necessary for the above reasons.