It is crucial for CAOCAO to conduct its business in an honest and transparent manner with high ethical standards. As regards data privacy, CAOCAO treats personal information and data with great care. CAOCAO is hereby committed to protecting your privacy and we will collect, use, share and protect your personal data pursuant to this Privacy Policy dated Avril 8, 2020 (hereinafter, "this Policy"). This Policy sets out the information we collect, the terms of use and sharing of the information collected and your rights in relation to such information. Please carefully read and make sure you understand this Policy before using CAOCAO’s products and services.

1.Data Controller

3. Sharing and Disclosure of Information

4. Retention and Deletion of Information

5. Place of Information Storage

6 . Safety Precautions

7 . Handling of Safety Incidents

8 . User’s Right

9 . Changes

10. Contact Us

1. Data Controller

The data controller is CAOCAO Mobility Paris.

102 Rue Victor Hugo 92300 Levallois-Perret France

CAOCAO Data Protection Officer can be reached at DPO@caocao.fr

Or by post at:

102 Rue Victor Hugo

92300 Levallois-Perret

France

2. Collection and Use of Data

2.1 Scope of application

This Policy globally applies generally to all users who use our app, websites and features or who request or receive the transportation service.

2.2 Processing of your data

The following is a list of what personal information we collect and the sources thereof, how we use it, and the legal basis for processing information under applicable laws in EU:

Categories	Source of information	Purpose of processing	Retention Period
Identity information: name, email, phone number, payment or bank information including relevant payment verification information, date of birth, gender(optional), photo/avatar(optional), Legal Basis: Contract fulfillment for account creation and update. Legitimate interest for sharing and communication function. Article 6 Section 1 b) General Data Protection Regulation (hereinafter, "GDPR")	Information you provided	- Create or update your CAOCAO account - Enable relevant function (i.e. activate SMS function) so that you can share information with others, such as commending a certain driver, recommending CAOCAO to relatives and friends, or notifying others of your estimated time of arrival. - Enable communication between users, including the drivers. For example, the driver may send a message to or call the user to confirm the pick-up point.	Up to 5 years after the end of the contract.
Information you submit when you contact the customer service personnel of CAOCAO to give ratings, compliments for or comments on other users, or otherwise contact CAOCAO or provide information feedback. Legal Basis: Legitimate interest Article 6 Section 1 c) GDPR	Information you provided	- For the purpose of addressing your request. For example, forwarding your questions to appropriate customer service personnel; investigating and answering your questions; monitoring and Improving the responsiveness of our customer service personnel.	5 years from the date of communication of the information.
Location information determined through GPS, IP address, Wi-Fi Legal Basis: Your consent Article 6 Section 1 a) GDPR Note that location information will be collected from the driver during your ride and linked to your account, even if you have not enabled CAOCAO to collect your location information.	Information created by you during your use of our services	- To promote our service. For example, if you do not enable CAOCAO to collect your location information, you will have to manually enter your pickup address. - Create the usual address bookmark to enable quick access to previous destinations. - To track tride progress	2 months from the ride.
Transaction information including your order details (place of departure, destination, duration and distance), service provision date and time, charge amount and payment method. Legal Basis: Contract fulfillment for order details Legal obligation for tax purpose Article 6 Section 1 b) c) GDPR	Information created by you during your use of our services	- To provide our service; this includes automatic processing of your information to enable dynamic pricing. Upon use of this function, the fare for the ride will depend on several varying factors, such as anticipated time, distance of the expected route, anticipated traffic conditions, and number of users who use CAOCAO at the particular time.	Up to 5 years after the end of the contract.
Usage Information including date and time of access, application features or pages viewed, application crashes. Legal Basis: Contract fulfillment for service providing Legitimate interest for service promotion Article 6 Section 1 b) GDPR	Information created by you during your use of our services	- Perform necessary internal operations so as to provide the services of CAOCAO, including troubleshooting software errors and operational problems, conducting data analysis, testing and research, monitoring and analyzing the usage and activity trends, and optimizing relevant websites and APPs. - For testing, research, analysis and product development. On this basis, we are able to improve and promote the safety of our services, develop new functions and products, and facilitate the insurance and loan solutions relating to our services.	1 year from the ride.
Device information including hardware model, device IP address, operating system and version, software, file name and version, preferred language, unique device identifier, advertising identifier, serial number, dynamic device information and mobile network information. Legal Basis: Legitimate interest Article 6 Section 1 b) f) GDPR	Information created by you during your use of our services	- For safety purpose such as preventing, detecting and stopping fraud or dangerous behaviors.For example: for marketing purposes, we will sometimes give discount coupons to users, but it sometimes occurs that one user will create several accounts in one device just to earn coupons. This is a typical example of fraudulent behavior, because our aim is to have more users with one discount, , rather than one user with several accounts.	Up to 1 year after the end of the contract
Communication data of users who communicate with each other and with CAOCAO through the APPs, websites. For example, the driver and the user may call or send messages to each other in some countries without disclosing their own phone numbers to the other. To provide this service, CAOCAO will receive certain information relating to such calls or messages, including date and time of calling/message sending and contents of communication. Legal Basis: The pursuit of CAOCAO’s legitimate interest to allow users and drivers to communicate safely Article 6 Section 1 f) GDPR	Information created by you during your use of our services	- For customer support services (including to resolve disputes between users); - For safety and security purposes; - To improve our products and services and - For analytics.	6 months maximum after the communication. Throughout the duration of a possible dispute. For the Data necessary to ensure communication between drivers and users, it may be retained for the duration of the use of the service by the users.
Information from other sources Legal Basis: Contract, Legitimate interest	- Users who request the services for you or on your behalf, from whom we will acquire your phone number. - Users or anyone else who offer your information in connection with a claim or dispute. - The business partner of CAOCAO through whom you create or access the CAOCAO account, such as payment service provider, social media service provider, application or website which uses CAOCAO API, or application or website whose API is used by CAOCAO. - - The head of the Tribe in which you participate. - Public sources.	- Provide and promote service; protect legitimate interest of users and other third parties	2 years from the collection of the information.

In the interests of further clarity, in CAOCAO’s legitimate interest, CAOCAO may use the collected information to present you products, services, discounts/awards, researches, investigations, news, latest trends, and activities that are similar and related to the service we are offering to you. For such purpose, your personal data will not be kept for more than 5 years after the last active contact you made with us. We may use the collected information to handle issues as permitted by applicable laws, or to comply with the requirements and official investigations from the supervisory authority and government.

With respect to all uses of your personal information beyond the scope directly or reasonably associated with the purposes stated in the section "Collection of Personal Information", we will further notify you of the same and obtain your express consent.

2.3 The interpretation of legal basis

The GDPR requires companies processing the personal data of the users on the basis of specific legal grounds. As stated in the table above, CAOCAO processes the information of the users based on one or more of the grounds specified under the GDPR. To facilitate your understanding, we interpret the categories of legal basis as follows:

(1) Such processing is necessary to provide the services and functions you request to fulfill our contract

%2. CAOCAO must collect and use certain data in order to provide its services and fulfill the contract between CAOCAO and the users. The information includes :

• The profiles and personal information of the users that are necessary to establish and maintain your account, including verifying your identity, communicating with you about your rides, orders and accounts, and enabling you to make or receive payments.

• Transaction information which must be generated and maintained in connection with the users' use of the services of CAOCAO.

• Usage information which is necessary to maintain, optimize and enhance the services of CAOCAO, including to determine, sometimes in combination with other information, incentives, connect users and drivers.

%2. Collection and use of such information are a precondition of using the CAOCAO application.

(2) Such processing is necessary to protect the vital interests of the Users of CAOCAO or of others

%2. CAOCAO may process relevant personal information, including disclosing data to the law enforcement authorities in case of threats to the safety of the users or of others.

(3) Such processing is necessary for CAOCAO's legitimate interests

%2. CAOCAO will collect and use personal information to the extent necessary for its legitimate interests. This includes collecting and using information:

• To prevent, monitor and combat fraud in connection with the use of the services of CAOCAO. For example, CAOCAO uses profiles, locations, devices and usage information of the users to identify and prevent behaviors by which users attempt to defraud CAOCAO or other users.

• To provide customer service.

• To enforce the Terms of Service of CAOCAO.

(4) Such processing is necessary to fulfill the legal obligations of CAOCAO

%2. CAOCAO is subject to legal requirements in the jurisdictions in which it operates that require us to collect, process, disclose and retain your personal information. For example, CAOCAO is subject to laws and regulations in many cities and countries that require us to collect and retain information about your rides, to retain such information for extended periods of time, and to provide copies of such information to the government or other authorities. CAOCAO will use your information to comply with such laws to the extent that they apply to your use of the CAOCAO application.

%2. CAOCAO may also share relevant information with the law enforcement authorities, or upon request by third parties pursuant to legal processes.

(5) Consent

%2. CAOCAO may collect and use your information upon your consent. You may revoke this consent at any time and free of charge. If CAOCAO has collected and used relevant information upon your consent, but you revoke your consent later, you will not be able to use any services or functions that require collection or use of such information.

%2. CAOCAO can collect and use data, upon your consent,

• To optimize the services of CAOCAO and develop new services so as to enhance you using experience. This includes, for example, recommending (new) functions, improving navigation, enhancing pricing, and matching users and drivers.

• For research and analytical purposes. This includes, for example, analyzing usage trends to improve user experience and enhance the safety guarantee of the services of CAOCAO.

• For direct marketing purposes. This includes, for example, analyzing data to identify market trends and tailor marketing messages to user needs.

CAOCAO will collect or use the following types of data upon your permission:

• Location information

• Shared live location information

• Notifications: Account and ride updates

• Notifications: Discounts and news

%2. CAOCAO may also collect your personal information through voluntary surveys. CAOCAO will collect your responses to such surveys upon your permission. Furthermore, CAOCAO will delete the collected information once this information is no longer necessary for the purposes for which it is collected.

3. Sharing and Disclosure of Information

CAOCAO will not share your personal information to any other third party unless as set out below or where you consent such sharing:

3.1 With drivers

We may notify the driver of your name, average of ratings given by the drivers and pick-up and/or drop-off location and geolocation position if you agreed to be localized.

3.2 Upon your request

This may include sharing your information with:

(1) Others you request. For example, we may notify your friends of your estimated time of arrival and location upon your request.

(2) The head of the Tribe to which you participate.

3.3 With service providers and business partners of CAOCAO

CAOCAO may provide its suppliers, consultants, marketing partners, research institutions and other service providers or business partners with information. This includes:

(1) The parties who process and give assistance in payment.

(2) Marketing partners and marketing platform providers.

(3) Data analysis providers.

(4) Research partners, including partners who maintain cooperation with CAOCAO or engage in questionnaire surveys or research projects on behalf of CAOCAO.

(5) Suppliers who assist CAOCAO in improving safety guarantee of CAOCAO applications.

(6) Consultants, lawyers, accountants.

(7) Fleet-partner.

(8) Vehicle leasing suppliers or third party vehicle suppliers.

3.4 Out of judicial causes or in case of disputes

We may share your information if CAOCAO is required to do so by applicable laws, regulations, legal proceedings or the government, or we should do so due to safety or similar concerns.

This also includes sharing your information with other parties in connection with merger or sale of corporate assets, or upon consolidation, reorganization, financing or acquisition or M&A of the businesses of CAOCAO, as a whole or in part by other companies, or during all such negotiations.

3.5 After the obtention by CAOCAO of your permission

If we have given a notice to you and obtained your permission to share the information, CAOCAO may share your information in circumstances other than those stated herein.

4. Retention and Deletion of Information

You can delete your account at any time through the privacy settings in the CAOCAO application or by contacting the customer service personnel. In some cases, it may be impossible for CAOCAO to delete your account. For example, there are outstanding payments or unresolved claims or disputes in your account. Upon resolution of the issue preventing deletion, CAOCAO will delete your account as described above.

Upon deletion of the account, CAOCAO will retain certain information, which includes information relating to transaction, location, device and usage, for a maximum of 5 years from the end of the service. In order to comply with our tax and accounting obligations, we will keep your data for a maximum period of 10 years. If we need to resolve any dispute before the competent courts and authorities, unless we are required by law, regulations, insurances and other requirements in the place of business operation to delete it, we will keep them for the duration of the dispute, increased by the legal appeal periods . If, after the aforementioned retention period, such information is no longer required to provide the services and customer service support of CAOCAO, CAOCAO will delete the data, or take measures to anonymize encrypt, isolate and archive such information to prevent anyone from accessing or using such information for any purpose other than complying with these requirements. You can have more specific details about the retention of your personal data in section 2.2 “Processing of your data”.

Where necessary, CAOCAO may also retain information, such as name, ID, transaction, device and usage of the User for the purpose of protecting its legitimate commercial interests, such as preventing fraud and enhancing safety. For example, if CAOCAO closes the accounts of the users for unsafe behaviors or safety incidents, CAOCAO may retain certain information about the accounts to prevent the users from creating new CAOCAO account in the future.

5. Place of Information Storage

The information we collect about you will be stored in Frankfurt, Germany.

6. Safety Precautions

We will adopt strict safety systems and prevailing safety technologies and procedures in the industry to prevent your personal information from loss, disclosure, destruction or unauthorized access and use. We will employ the following safety technologies and measures to protect your personal information:

(1) Encrypting and storing the personal information about users in the server and storing the same through data isolation technologies.

(2) Using encrypted transfer protocol during data transfer.

(3) Strictly controlling the data access permission, and establishing complete sensitive data access permission application and approval systems.

(4) Establishing safety monitoring and auditing systems and conducting comprehensive data safety control.

(5) Establishing agreements for the exchange of information and software between the organization and external parties.

(6) Establishing procedures for monitoring use of information processing facilities and regularly reviewing the results of monitoring activities .

(7) Establishing, documenting and reviewing an access control policy based on business and security requirements for access.

(8) Controlling access to operating systems by means of a secure log-on procedure.

7. Handling of Safety Incidents

In the event of a safety incident, we will promptly notify you of the basic information and risks about the incident, the measures we have taken or will take, and the suggestions on the measures you can take yourself to lower the risks . We will promptly notify the affected users of the safety incidents through push notification, letter or call. When it is difficult to send notifications to the users individually, we will post warning information through an announcement on the platform

8. User’s Rights

8.1 Rights

You have the following rights with respect to CAOCAO's processing of your personal information. To exercise these rights, please read below.

(1) Access to your personal data

You have the right to access your personal information that CAOCAO has about you:

On the CAOCAO’s app, you can already access some of this information by:

i. Clicking your profile picture on the inner sidebar of the app to view your profiles

ii. Clicking "Ride" in the inner sidebar of the client to view your ride history

iii. Clicking "Payment Method" in the inner sidebar of the client to view the payment mode you set

(2) Explanation and copies of personal data

i. You have the right to request from CAOCAO an explanation of your personal information it has and how this information is used.

ii. You also have the right to receive a copy of your personal information that CAOCAO collects.

(3) Correction

If CAOCAO has your personal information that you believe is inaccurate, you have the right to request correction of these information.

You may also edit the name, phone number and email address associated with your account through the "Settings" menu in the CAOCAO application.

(4) Deletion

%2. You have the right to request the deletion of your account or any personal data relating to you at any time. You may delete your accounts and your personal data through the account termination in the CAOCAO application or by contacting the customer service personnel. Please refer to the “Contact Us” section of this Privacy Policy. We may retain some items of your personal information as required by law or for legitimate business purposes permitted by law.

%2. Please see the "Retention and Deletion of Information" section above for more information regarding the information retention and deletion practices of CAOCAO.

(5) Withdrawal of consent

You have the right to withdraw your consent at any time and free of charge. We will guarantee your right to withdraw consent by:

i. Setting cancellation of permission relating to the system through the system's authorization to APP

ii. Allowing removal of the bound personal payment mode through the "Payment Method" in the sidebar of the client

iii. Allowing removal of associated contacts through the "Tribe Group" in the sidebar of the client

(6) Objections and complaints

%2. Users in the European Union have the right to object to CAOCAO's processing of personal data, including for marketing purposes based on data analysis and/or automated decision making. CAOCAO may continue to process your information to the extent permitted under GDPR notwithstanding your objection.

%2. You may also submit questions, suggestions or complaints to the Data Protection Officer of CAOCAO.

%2. You also have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
For France, the competent supervisory authority will be the Commission Nationale de l’Informatique et des libertés and your rights can be exercised at 3 place de Fontenoy, 75007 Paris or by phone on 0033 1.53.73.22.22.

For United Kingdom, the competent supervisory authority will be the Information Commissioner’s Office and your rights can be exercised at Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF or by phone on 0044 303 123 1113.

(7) Right to portability

You have the right in certain circumstances to receive the personal data concerning yourself which you have provided to CAOCAO, in a structured, commonly used and machine-readable format, and to transmit them to another controller.

(8) Post-mortem right to privacy

You have the right to set instructions regarding the storage, deletion or communication of your personal data after your death.

8.2 Privacy Settings

(1) Settings

"Settings" or system settings of the CAOCAO application enables the users to set or update their location and contact information sharing preferences, and their preferences for receiving mobile notifications from CAOCAO. Information on these settings, how to set or change these settings and the effect of turning off these settings are described below.

i. Location information

• CAOCAO uses the device location services of the Users to provide the users with safe, reliable travel experience whenever they need. Location data helps improve our services, including pick-up, navigation and customer service.

• You may enable/disable the permission for CAOCAO's collection of user location information at any time via the settings on your mobile device or adjust relevant setting. If you disable the device location service on your device, your use of the CAOCAO user client will be affected. In addition, location information will be collected from the drivers during your rider and associated with your account, even if you have not permitted CAOCAO to collect your location information.

ii. Device permission

Most mobile platforms (iOS, Android, etc.) have defined certain types of device data that applications cannot access without your permission. In addition, these platforms have different permission systems for obtaining your permission. The iOS platform will remind you the first time the CAOCAO application requests permissions to access certain types of data and will ask for you consent (or not consent). Android devices will notify you of the permissions that the CAOCAO application seeks before you first use the application, and your use of the application constitutes your consent to grant these permissions.

iii. Usual Address

You may set and reserve a usual address though “Setting-Usual address”. You can also update and delete it through the same channel.

8.3 Transfer of Personal Data Outside of the European Economic Area

We may transfer information that we collect about you to affiliated entities, or to other third-parties located in countries or jurisdictions which are not part of the European Economic Area (EEA), i.e China for purposes of the maintenance of the platform and provide Pick-up and transport services to Chinese tourists.

When your data is transferred to affiliated entities or third-parties located in countries in which the legislation is not offering an equivalent level of data protection as in the European Economic Area, we use the “Standard Contractual Clauses” agreed by the European Commission as adequate safeguards to secure the transfer of your data and their processing.

You can obtain a copy of these adequate safeguards by requesting them. Please refer to the “Contact us” section of this privacy policy.

In addition, we may transfer your personal data to a State which is not considered by the European Commission or the CNIL as offering a level of legal protection of personal data that is equivalent of the one in force in France, if you have expressly consented to their transfer or if the transfer is necessary under one of the following conditions:

- to the safeguarding of your life;
- to protect the public interest;
- to comply with obligations to ensure the establishment, exercise or defense of a legal claim;
- to the consultation, under regular conditions, of a public register which, by virtue of legislative or regulatory provisions, is intended for the information of the public and is open to consultation by the public or by any person proving a legitimate interest;
- the performance of a contract between CAOCAO and you, or pre-contractual measures taken at your request;
- the conclusion or performance of a contract concluded or to be concluded, in your interest, between CAOCAO and a third party.

Where a transfer could not be based on Standard Contractual Clauses for the transfer of personal data to third countries and none of the derogations for a specific situation referred to in the paragraph above apply, a transfer to a third country or an international organization may take place if it is necessary for the purposes of compelling legitimate interests pursued by Caocao which are not overridden by your interests or rights and freedoms. In this specific case, we will provide suitable safeguards with regard to the protection of personal data and inform you and the supervisory authority of the transfer, of the compelling legitimate interests pursued.

9. Changes

We may occasionally update this Policy. If we make significant changes, we will notify you of these changes through the CAOCAO application or through others means, such as email.

Significant changes for the purpose of this Privacy Policy include:

(1) Significant changes to our service patterns. Such as purpose of personal information processing, type of personal information processed and how to use personal information;

(2) Changes to the persons or entities to whom personal information is shared, transferred or publicly disclosed;

(3) Significant changes to your rights to participate in processing of personal information and way of exercise thereof;

(4) Other changes that may impose significant impacts on your interests in relation to your personal information.

We encourage you to periodically review this Policy for the latest information on our privacy policy.

10. Contact Us

For any questions regarding this Policy, you may contact CAOCAO through the "Feedback" or by the email DPO@caocao.fr. CAOCAO may verify your identity and will make a reply or reasonable explanation within 30 days upon verification of your identity. The period may be extended by two further months where necessary, taking into account the complexity and number of requests. You will be informed of any such extension within one month of receipt of the request, together with the reason for the delay.