This Privacy Policy (Policy) applies to the Users of Pathao Nepal Private Limited (hereinafter the ‘the Company’ or ‘Pathao’ or ‘We’ or ‘Us’), an IT-enabled services company that provides among other ride hailing, food delivery, parcel and logistics services (hereinafter the ‘Services’ or ‘Pathao Services’) to its customers and merchants (Users) through its mobile application (‘Pathao App’ or ‘App’) and website (together be referred to as the ‘Platform’). Please see the Terms and Conditions of Pathao Nepal Private Limited, which may contain additional terms regarding privacy and our use of information about you.

Unless otherwise indicated or the context requires otherwise, references to “you” or “your” are intended to refer to a User, and references to “Pathao”, “we”, “us” or “our” in this Policy include Pathao Limited (the Company) and its Affiliates and Subsidiary Companies.

For being registered with Pathao, creating a User Account, and availing Pathao Services, Users shall be required to accept through clicking in-app acceptance button, this Privacy Policy along with all other relevant Pathao Terms and any amendments, addendums, and alterations thereto, and such online acceptance shall constitute a legally binding agreement between the Company and the User.

The User explicitly and unambiguously consents to the collection, storage, use, and transfer, in electronic or other forms, of their personal information as collected during the Registration Process or at any subsequent stages of the Service for the exclusive purpose of the smooth completion of the Service required by them.

In connection with the collection, storage, transfer, and use of their personally identifiable information, the Company complies with all applicable laws relating to data privacy in Nepal along with its Privacy Policy. The Company has commercially reasonable physical, technical, organizational, and administrative security measures and policies in place to protect all personal information collected by it or on its behalf from and against unauthorized access, use, and/or disclosure and is committed to full compliance with the provisions of the personal data protection laws of Bangladesh.

The User agrees and consents to the Company collecting, using, disclosing and processing its Personal Information/Data for the purposes and in the manner as identified hereunder.

1. What Personal Information We Collect

We collect and use personal information from and about you, including when you interact with us, register for or open a Pathao User Account, request for any service, conduct any financial transactions using Pathao, or otherwise visit or use Pathao Services. The personal information that we collect includes:

1. Registration Information: your basic personal details including first and last name, date of birth, and NID, contact information including your address, phone number, email, or other information that permits us to contact you and other registration details;
2. Financial information: including bank or wallet account details, billing and delivery information, transaction data, credit/debit card numbers and cardholder names, expiration dates and bank statements;
3. Payment Transaction details: including name, account number, contact information and/or other information relating to you or the recipient of a payment, remittance or fund transfer;
4. Technical information including any information obtained from the device you use to interact with us that includes IP address, geographical location, device identification codes and other features/data that can be used to identify a device;
5. Information from your visits to our websites or mobile app (Platform) including browser/platform type and version, internet service provider, operating system, referral source/exit pages, length of visit/usage, page views and any search term you use, device logs in the event of a crash or error report;
6. Cookies: when you access Pathao through a browser, we send one or more cookies – a small file containing a string of characters – to your computer or device to uniquely identify your browser. We use cookies to improve the quality of our service by storing user preferences and tracking user trends. Most browsers are initially set up to accept cookies, but you can reset your browser to refuse all cookies or to indicate when a cookie is being sent. Please note that you will not be able to access certain features of Pathao if your cookies are disabled. Moreover, in providing the Services, Pathao may avail support from other companies for usage and business data analytics, advertisement, etc. who may use cookies, web beacons, SDKs, and/or other technologies to collect and process data.

2. How Do We Collect your Personal Information

We collect personal information about you in connection with the Pathao Services. For example, we collect your personal information when you browse our website, register as a User of Pathao Services, log into your User Account to avail our Services; or when you participate in one of our loyalty or promotional events, or when you communicate with us by phone, e-mail, web-chat or otherwise, etc.

We also receive personal information about you from other sources, including

• Pathao Affiliates or Subsidiary Companies and other third party suppliers or merchants providing services on our behalf;
• Any other merchants from which you buy goods or services using Pathao Services;
• Banks and other payment institutions that we collaborate with to provide you with the Pathao Services;
• Credit reference and fraud prevention agencies; and
• Publicly available sources.

We combine information that we have about you from various sources including the information you have provided to us.

3. How and Why Do We Use Your Personal Information

We use the information we collect to operate our business, including provision of Pathao Services. We may use your personal information for the following purposes:

1. verifying your identity, including during account creation, payment or transaction processing, password reset processing, etc;
2. verifying your eligibility as a User of the Pathao Services (including anti-money laundering and counter-terrorist financing checks and verification);
3. processing, maintaining and managing your registration as a User of the Pathao Services;
4. providing you with Pathao Services and other related services, including operating the Pathao Services and enabling transactions, customizing your user experience, facilitating the payments, fund transfers, refunds, sending notices about transactions, and responding to your queries, feedback, claims or disputes;
5. contacting you in relation to our provision of Pathao Services and other legal purposes, contacting you in connection with any communication preferences or requests you have expressed, asking you for feedback about Pathao Services or other related products and services;
6. collecting feedback from you and your staff (if you are a merchant user) about our products and services and using such feedback to improve our business and/or customize products and services for you;
7. sending you direct marketing or other information about products and services offered by us, other Pathao Affiliates, our business partners or other third parties; including for promotional purposes;
8. managing risk, performing creditworthiness and solvency checks, or assessing, detecting, investigating, preventing or remediating fraud, data breaches or other potentially prohibited or illegal activities and otherwise protecting the integrity of our payment system;
9. detecting, investigating, preventing or remediating violations of your agreements with us or any merchant or any applicable policy, industry standards, guidelines, regulations and laws prevailing in Bangladesh and our policies;
10. making disclosures as may be required by any law or regulation or by any government bodies. Disclosures may also be made pursuant to court order or other legal process or requirement applicable to us or any Pathao Affiliates (including anti-money laundering and counter-terrorist financing reporting requirements or other commercial disputes);
11. making disclosures to third parties including relevant regulators to prevent any harm or financial loss, to report suspected illegal activity or to establish, exercise or defend claims or potential claims on behalf of ourselves or any Pathao Affiliate company; or to enable any due diligence and other appraisals or evaluations for any actual or proposed merger, acquisition, financing transaction or joint venture.
12. conducting research and analysis, or otherwise using data to improve, optimize and expand the product functions of the Pathao Services, if applicable, to develop related products and services;
13. managing our business including protecting Users, prevent harm, fraud, or theft to ourselves and others, maintain the security of our products and services, and protecting our rights or property and those of others; and
14. otherwise for everyday business purposes, to comply with the law, or in other ways for which we provide specific notice at the time of collection.

4. With Whom We Share Your Personal Information

a. We are committed to not sell or rent your personal information to companies or individuals outside of Pathao for any undue gains or benefits. If you are availing any service or making a purchase through Pathao, we may share required portions of your personal information with the retailer to identify the transaction, but we will not share your full information with the retailer without your opt-in consent, except in the limited circumstances described below. In addition, we will only share your personal information with other companies or individuals outside Pathao as permitted by this Policy and in the following circumstances.

b. We share your personal information to operate and manage our business to serve you, including for the purposes indicated hereunder:

• Affiliate entities of Pathao providing services on our behalf or to which we provide Services;
• third parties including any agent, contractor or third party service provider that we work with in providing Pathao Services. For example, we work with freelancer rider or delivery agents to provide ridesharing, food delivery, or courier logistics services or with third party service providers who we collaborate with for fraud prevention, anti-money laundering checks, credit checking, bill collection, data entry, database management, promotions, marketing, customer service, technology support, products and services alerts, payment settlement and processing and payment extension services;
• entities with whom Pathao maintains collaborative service arrangements, including registered merchants and Pathao Affiliates;
• banks, card associations, payment networks or acquiring institutions, Pathao Affiliate and others involved in conducting and processing financial transactions of Pathao Services;
• law enforcement agencies, insurers, government and regulatory authorities or any other organizations to which Pathao, or any Pathao Affiliate company or third party service provider is under an obligation to make disclosure under the requirements of any applicable law, regulation or commercial arrangement and who can help us to detect, prevent or otherwise address fraud, security or technical support;
• individuals and entities involved in any merger, acquisition, corporate reorganization or financing, or similar transaction with us, including in the event of the sale of all or part of our assets;
• our own and others’ professional advisors (e.g., lawyers, accountants, auditors and trustees) engaged by our service partners.
• We require opt-in consent for the sharing of any sensitive personal information, except as otherwise described in this section.
• If you are using a credit or debit card issued by a bank and card association to perform an online transaction, the licensed Payment Processor engaged by us to process the transaction shall receive your card number and other necessary card details you must provide;
• We may share aggregated non-personally identifiable information with our engaged third party service providers to enhance your user experience. For example, we may share the overall usage of Pathao services in a particular geographic area or that a certain percentage of users use a particular type of Pathao Service. However, if we share this aggregated information, we do not include personally identifiable information without your explicit opt-in consent or in the limited circumstances described above.
• We provide such information to our Affiliate companies or other businesses or entities for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Policy and any other appropriate confidentiality and security measures.
• We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce applicable Terms of Service, including investigation of potential violations thereof, (c) detect, prevent or otherwise address fraud, security or technical issues or (d) protect against imminent harm to the rights, property, security or safety of Pathao App, its users or the public in general as required or permitted by law.

c. If Pathao or its Affiliates or subsidiary companies become involved in a merger, acquisition or any form of sale of some or all of their assets, we will provide notice before personal information is transferred and become subject to a different privacy policy.

5. How Do We Store, Retain and Protect Your Personal Information

a. We will keep your personal information in accordance with our policies and for as long as it is necessary to provide you with the Pathao Services or other purposes as set out in this Policy. In addition, we may retain your personal information for a longer period (in some cases, up to 06 (six) years after the closure of the User Account or minimum 12 (twelve) years in some other cases).

b. We use a variety of security measures, programs and technologies designed to help protect your personal information from unauthorized access, use, disclosure, alteration or destruction consistent with applicable data protection and privacy laws and regulations applicable in Bangladesh. These include internal reviews of our data collection, storage and processing practices and security measures, as well as physical and technical security measures from unauthorized access, use, disclosure, alteration or destruction consistent with applicable data protection and privacy laws and regulations. For example, your banking information will always be stored in an encrypted form (except when you provide it to us in a communication outside our platform interface).

c. The security of your Pathao User Account also depends on keeping your account password confidential, and you should not share your account name or password with anyone. Our staff will never ask you for your password in an unsolicited phone call or in an unsolicited email. If you share a device with others, you should not choose to save your log-in information for the Pathao Services (e.g., user ID and password) on that shared device.

d. The Pathao Services information security program does not apply to any information, arising from a Third Party Service Provider, that is stored on your Pathao App, as that information is outside of the Pathao-controlled data centers. It is your responsibility to control access to your mobile device and the Pathao App on your device, including keeping your PIN confidential and not sharing it with anyone. It is your responsibility to alert Pathao or the relevant partner if you believe that the security of the information in the Pathao App has been compromised.

6. ACCOUNT AND DATA DELETION POLICY

a. Pathao Users can opt for Account and Data deletion by navigating through the relevant menus in the Pathao App. Following an Account Deletion request, we will delete the User Account and Data except as necessary for purposes of safety, security, and fraud prevention as stipulated in this Policy and subject to legal provisions relating to data storage and retention.

b. Pathao usually deletes relevant User data within 30 (thirty) days of an account deletion request, except where retention is necessary as per this Policy.

c. Once deleted, Pathao Users may be allowed to recover their Accounts and Data by logging in to his/her account within 30 (thirty) days after deletion using the previous credentials. After 30 (thirty) days of deleting the Account, Users will be required to re-register to use Pathao Services.

d. The Users shall not be allowed to delete the Account or the account deletion request shall not be acceptable where:

1. any outstanding payment is due to Pathao. Users need to clear off all the dues before submitting the deletion request;
2. any service order is active or under process. Account Deletion requests shall be accepted only when such order is completed;
3. User account deletion requests will only be processed by Pathao if the account is in good standing or not subject to any kind of suspension or remedial measures.

7. Personal Information about Children

Our services are not directed towards users under 16 years old. If you are under 16, please do not use Pathao Services.

If you are above 16 years and below 18 years old and intend to use our Services, you must ask your parents or legal guardian to read this Policy thoroughly and agree to the terms and conditions of service and privacy policy on your behalf. In addition, you must submit with Pathao your age identification document (NID) and a letter of consent from your parents or legal guardian permitting your use of Pathao App and its services under their supervision. If your parents/legal guardian disagrees with your use of our services or provision of information to us in accordance with this Policy, please do not register or cease immediately the use of our services and notify us promptly so that we can take appropriate actions.

8. Third-Party Service and Sites

We may provide links to our Affiliates or Subsidiary companies, or other websites, apps and services (including other online merchant sites) for your convenience and information. These services, apps and websites may operate independently from us. Linked services, apps and websites may have their own privacy policies, which we strongly suggest you review if you visit any linked websites. To the extent any linked websites you visit are not owned or controlled by us, we are not responsible for these websites’, apps’ or services’ content, any use of these services, apps or websites by you, or the privacy practices of these services, apps or websites.

9. Legal Basis for Using Your Personal Information

We use your personal information on the following bases:

• For the performance of Pathao Terms and Conditions or other contracts to which you are a party.
• To comply with legal and regulatory obligations.
• For legitimate business purposes.
• Using your personal information helps us to operate and improve our business for you and minimize any disruption to the Pathao Services that we offer to you. It also allows us to make our communications with you more relevant and personalized and to make your experience of our services efficient and effective.
• We do not proceed to using your personal data for our legitimate business purpose as stated above unless we think we have secured your rights to privacy, freedom of use, and interests.

10. Your Rights to Protect Your Personal Information

In accordance with applicable data protection and privacy laws and regulations, you may be entitled to:

• ask us about the processing of your account-related personal information,
• request the correction and/or (in some cases) deletion of your account-related personal information;
• in some cases, request restriction of processing of your account-related personal information, or object to that processing;
• withdraw your consent to the processing of your account-related personal information (where Pathao is processing your account-related personal information based on your consent);

Where you are given the option to share your account-related personal information with us, you can always choose not to do so. If we have requested your consent to process and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. You may opt for Account deletion and Data deletion as per the Clause 6 above or through contacting us using the details set out in the ‘Contact Us’ section below.

11. Changes to this Policy

Please note that this Privacy Policy may change from time to time. We will not reduce your rights under this Policy without your explicit consent. We will post any Privacy Policy changes on this page and, if the changes are significant, we may provide a more prominent notice (including a notification in your account interface/app-in message or email notification, or by publishing announcements on our website). Each version of this Privacy Policy will be identified at the top of the page by its effective date and we will also keep prior versions of this Privacy Policy in an archive for your review.

12. Contact Us

If you have questions or requests about the privacy issues relating to the processing of your personal information or account deletion, you can contact us by email at [email protected] or coming to our business address: Nava Srijana Marg-10, Mid Baneshwor, Kathmandu, Nepal. As required under applicable laws of Nepal, please note that we may take steps to ask you to provide further information to verify your identity before granting you access to information or acting on your request to exercise your rights.