PARK24 INTERNATIONAL LIMITED

NCP CAR - PRIVACY NOTICE

Protecting your personal data is of great importance to PARK24 INTERNATIONAL Limited（“we“, "our" or "us"）.

We process the personal data of the customer（referred to as a “Customer” or “you” throughout this privacy

notice) who becomes a member of our car-sharing service in accordance with UK GDPR and other relevant

English data protection law, such as the Data Protection Act 2018. This privacy notice explains how we process

your personal data as part of the car-sharing service.

1. What personal data do we collect?

We collect and process various categories of personal data for the purposes of our car-sharing service. The

categories of personal data that we collect may include the following:

(1) identification data: first and last name, email address, phone number, physical address, date of birth,

employer, photograph and driving licence information (Note: we need a photograph of front and back of

licence, but we don’t use driving licence codes on the back of your licence for any purpose);

(2) electronic identification data: Customer ID, user name, login password, IP addresses and mobile device

IDs;

(3) payment data: payment/credit card information and billing address;

(4) transaction data: details of car sharing services obtained and transaction history, including reservation

number, reserved vehicle, departure/return station, time and duration of reservation, cancellation of

reservation and actual usage time, including extensions (with or without permission);

(5) vehicle usage data: travel time, mileage/distance travelled, fuel/charge level, speed/acceleration

(dependent upon the vehicle being used) and certain events (engine start/stop, door lock/unlock, booking

start/stop and their timestamp);

(6) geolocation data (from our telematics devices and your smartphone);

(7) details of any accidents/collisions;

(8) complaint information;

(9) marketing preferences;

(10) surveys/questionnaires;

(11) call recording of any calls made our contact centre;

(12) fixed penalty notices (FPNs) and penalty charge notices (PCNs); and

(13) any other information provided voluntarily by the Customer.

2. For what purposes do we collect and process your personal data?

We collect and process your personal data: (a) to confirm your eligibility to become a member of the car-sharing

service and make decisions about whether or not to provide car-sharing vehicles to the Customer; (b) to identify

you; (c) to provide and maintain the car-sharing service and take payments; (d) to monitor the usage of car-

sharing vehicles, and detect, prevent and address technical issues and for fleet management purposes; (e) to

conduct questionnaire surveys or interviews and gather analysis or valuable information so that we can improve

the car-sharing service, in particular, to identify any issues/areas of improvement; (f) to resolve any issues or

deal with accidents caused by usage of the car-sharing vehicles and provide other customer support; (g) to

comply with the applicable law, (h) to send you promotional information of our services and (i) to manage our

business.

We process geolocation data from your smartphone and from the telematics device installed in our vehicles

to assist you in finding the nearest car park and facilitate car rental bookings. Geolocation data from our

telematics devices is collected to protect the cars from car theft, to provide support to customers while the rental

is active, to manage departure/return of the vehicle and charge the correct fee. You have control over

geolocation data obtained from your smartphone, by choosing to limit the use of location data while the app is

in use.

Our processing of your personal data is based on the below lawful bases:

Purpose of the

processing

Legal bases of the processing

(a)

・ performance of contract

・ legitimate interest (to ensure effective administration and management of your

relationship with us, including in relation to any reservations or eligibility for

membership)

・ legal obligation

(b)

・ legitimate interest (to ensure that we identify you for both your and our protection)

・ legal obligation

(c)

・ performance of contract

・ legitimate interest (to understand how you use our services and to manage our

vehicle fleet and to provide appropriate services to you)

・ legal obligation

(d)

・ legitimate interest (to prevent, detect, or investigate any technical issues with our

vehicles, to protect our assets and any unauthorised use of our vehicles and

systems, and ensure we comply with our policies)

(e)

・ legitimate interest: (ⅰ) to carry out research and analysis on what services or

products you want or how you would like us to improve our services and

products; (ⅱ) to better tailor and personalise the promotions and benefits that we

offer to you and (iii) to improve the car-sharing service, in particular, to identify

any issues/areas of improvement prior to the official launch of car-sharing

business

(f)

・ legitimate interest (to manage our relationship with you and resolve any issues, to

deal with any disputes and accidents, and take legal or other professional advice)

・ legal obligation

・ to protect your or another person's vital interests

(g)

・ legitimate interest (to manage our business)

・ legal obligation

(h)

・ legitimate interest (to promote our services that may be of interest to you)

(i)

・ legitimate interest (to manage and improve our business generally)

Geolocation data

(smartphone)

・ consent

Geolocation data

(telematics)

・ legitimate interests (to protect our assets, to charge correct fee, to provide

customer support to manage vehicle departure/return and to manage vehicle

theft)

3. How we disclose your personal data?

We disclose your personal data to the following third parties in accordance with applicable law only to the extent

necessary to achieve the purposes set out in this privacy notice:

Third party recipient

Purpose of disclosure

IT service providers

(including our carsharing

technology platform provider)

and their sub-processors

・ operate and maintain IT systems for the car-sharing service

・ provide components associated with the systems such as

dashboarding tool, messaging tool, mapping and push notification tool

・ collect, collate and store various telematics data to provide us with

relevant information about car usage

・ analyse your use of the systems to identify any technical issues and/or

improvements in connection with them

Car-sharing vehicle leasing

company

・ administer the hire of car-sharing vehicles and provision of any related

services

Roadside assistance service

provider

・ identify the Customer as an individual, the subject vehicle and the

location of the rescue

Payment services provider

・ manage and take payment for car sharing services on our behalf

Contact centre for the car-

sharing service

・ respond to your inquiries appropriately by understanding information

about you or your use of car-sharing vehicle

・ record or track calls for quality control, training and (if necessary)

customer service improvement,

・ check your driving licence

・ manage payments

Our group or affiliated

companies (Park24 Co., Ltd.

and National Car Parks

Limited)

・ store and manage your personal data in its database

・ provide contact centre service and other relevant services enabling us

to provide car-sharing services

・ provide administrative services to us in order to enable us to run the

car-sharing service

Government, regulatory and

law enforcement agencies

・ verify your driver’s licence and ensure you meet our safe driver criteria

・ as requested by these agencies, if the disclosure is required or

permitted by law

・ take action regarding illegal activities or traffic offences

・ to assist the relevant authorities if we have a good faith belief that

there is an emergency that poses a threat to the safety of you or

another person

・ as otherwise required or permitted by law

Lawyers, accountants and

other external experts

・ take professional advice regarding the operation of the car-sharing

service

Employer of the Customer

・ confirm usage status of car-sharing vehicles where the Customer uses

them pursuant to a B2B Umbrella agreement arrangement

Buyers or investors

・ we may share your personal data with actual or potential buyers or

investors in relation to the sale or merger of, or investment in, our

business or part of our business

4. Is your personal data transferred to third countries?

We may transfer your personal data outside the UK (including to our group or affiliated companies). When we

do so, we will ensure that appropriate safeguards for that transfer are in place such as by (i) entering into

standard data protection clauses with the transferee as specified in a document issued by the Information

Commissioner under Article 46 of UK GDPR and Section 119A of Data Protection Act 2018 or (ii) transferring

your personal data to countries which have been deemed by the relevant authorities to provide adequate levels

of data protection.

If you wish to receive a copy of relevant standard data protection clauses, please inquire using the contact

details at the end of this privacy notice.

5. From where is your personal data collected?

We obtain your personal data from the reservation app, the devices loaded into the car-sharing vehicle

(including telematics), your contact with our customer service team and third parties who have a contract with

us regarding the car-sharing service. We also create some data ourselves in the course of providing the services.

If any of your personal data changes (e.g. your contact details), please let us know as soon as possible by

contacting the Data Compliance Desk (see details below). See also paragraph 7(3) below.

6. How long do we keep your personal data?

We will retain your personal data for as long as necessary to fulfill the above stated purposes for obtaining and

processing your personal data. In general, we may retain your personal data and records relating to the use of

car-sharing vehicle for seven years. This includes the data obtained from the devices loaded into the car-sharing

vehicle and records of your inquiries to the customer service centre.

7. What rights can you exercise regarding the processing of your personal data?

You have the foll owing rights regarding personal data obtained and processed by us. Note that there is no

automatic right to the data of any third parties and the right of access is subject to other exemptions from

disclosure:

(1) Obtaining information regarding processing of data: You have the right to obtain from us all the requisite

information regarding our data processing activities that concern you.

(2) Access to personal data: Subject to certain exemptions, you have the right to obtain from us copies of your

personal data that we have.

(3) Rectification of personal data: You have the right to have us rectify inaccurate personal data concerning

you that we have.

(4) Erasure of personal data: if certain conditions are satisfied, you will have the right to have us delete your

personal data.

(5) Restriction on processing of personal data: If certain conditions are satisfied, you will have the right to have

us restrict processing of your personal data.

(6) Objection to processing of personal data: If certain conditions are satisfied, you will have the right to object

to processing of your personal data.

(7) Data portability of personal data: If certain conditions are satisfied, you will have the right to receive your

personal data in a structured, commonly used, and machine-readable format and the right to transfer that

personal data to another controller without hindrance from us.

(8) Right to withdraw consent: Where our processing of your personal data is based on your consent, you have

the right to withdraw your consent at any time. Note that if you withdraw consent, this will only take effect

for future processing.

If you intend to exercise any of the above rights, please inquire using the contact details at the end of this privacy

notice.

You can lodge a compl aint in relation to our processing of your personal data with the Information

Commissioner’s Office (ICO, https://ico.org.uk/), or other relevant data protection supervisory authority. We

would however appreciate the opportunity to resolve your compliant first before you contact the ICO.

8. Other privacy notices

This privacy notice applies to your use of the car sharing service only. Please also read any other privacy notices

that we provide to you from time to time.

Please note that if you are our employee, this notice does not form part of your contract of employment or any

other contract between you and us.

9. How might this privacy notice be amended?

We may amend this privacy notice from time to time. We will contact you in writing and by email, if necessary,

where we make any substantive or material amendments.

10. Contact information

For questions or inquiries regarding this privacy notice, please contact our Data Compliance Desk set out below.

Data Compliance Desk

PARK24 INTERNATIONAL LIMITED

[Address] Saffron Court, 14b St Cross Street, London, England, EC1N 8XA

[Email address] dataprotection@ncpcar.uk

Version 1.0.0

Published on 10

May 2024