CARGO PRIVACY NOTICE

1. Date of issuance of the Privacy Notice

This Privacy Notice (Notice) has been issued on April 1st, 2018.

2. The purpose of the Notice

Transparency and care about your personal data are core values of our business. We process your personal data so that we could provide you with all the benefits of using the CAR:GO App. The intention of this Notice is to inform you about the way we at CAR:GO deal with your personal data. It explains how we collect, store or otherwise process personal data for the purpose of enabling you to use the CAR:GO App. This Notice is issued in alignment with the General Data Protection Regulation (GDPR) and the Personal Data Protection Act in Serbia (PDPA).

CAR:GO supports rights which originate from the GDPR and PDPA . We believe that individuals should have the right to control their data, regardless of their physical location.

By personal data we mean any information relating to an identified or identifiable natural person, such as a name, age, a photograph, or location data. Personal data does not include information that is anonymized.

Processing means any operation or set of operations which is performed on personal data, or on sets of personal data (such as collection, recording, storage, adaptation or alteration, erasure or destruction).

3. Changes and amendments

The last version of this Notice has been issued on August 16th, 2021.

Should this Privacy notice be updated or modified in a material way, we will update the last changes date of this Notice.
We will notify you in a timely manner of any change of this Notice.

4. About Us

In this Notice “CAR:GO”, “we” and “our” refers to CARGO Technologies doo, with its registered seat located at Dr Milutina Ivkovića 2A, Belgrade, Serbia.

CAR:GO is in certain situations during the processing of your personal data a controller; in certain situations a processor of your personal data and in certain situations just a recipient of your personal data. We shall elaborate further below.

Questions, concerns, complaints, or disputes regarding this Privacy Notice, data privacy at CAR:GO, or our compliance with the applicable data protection laws and regulations may be sent to us by email at [email protected]

We have appointed a data protection officer (DPO), who is responsible for ensuring that CAR:GO process your personal data in accordance with the valid legislation. Strahinja Devic is our DPO and you can reach him at [email protected]

5. Personal Data We Collect

A. Registration

When you register with the CAR:GO App, we collect information about you including but not limited to your name, your email address, your mobile phone number, your vehicle data (for the Service Providers). The CAR:GO App may also collect your photo. CAR:GO is a controller when processing your personal data for the purpose of registration and use of the CAR:GO App.

CAR:GO is a processor in processing of your personal data related to the CAR:GO Association. Namely, the CAR:GO Association engaged us for the purpose of membership administration activities and determined that only the members of the CAR:GO Association are eligible to register with the CAR:GO App. Therefore, when registering, a necessary condition for the successful registration is the acceptance of membership in the CAR:GO Association (Serbia).

We process your personal data for registration administration, to deliver member benefits to you, and to inform you of our services and other benefits or opportunities associated with your CAR:GO App membership.

B. Your use of the CAR:GO Service

While you use the CAR:GO Service CAR:GO acts as a processor. Namely, the Service Providers have engaged us for these purposes in order to be able to provide an innovative roadside assistance service and on that occasion, they process your personal data. The CAR:GO App is merely the processor in this processing activity.

We are a controller when the Service Providers use the CAR:GO App, for the processing of their data.

C. Your use of CAR:GO Butler Service

While you use CAR:GO Butler Service, we act as a processor in this data processing activity. Namely, the Merchants have engaged the CAR:GO App in order to provide their services (food delivery and other products) and related to this the Merchants process your personal data as controllers. CAR:GO is merely a processor in this data processing.

D. Administration of the Association CAR:GO Members (Serbia)

We are administering the membership of the Association CAR:GO members. The CAR:GO Association engaged us for said purposes and
we are a processor in that situation.

E. Video surveillance

Some of the Service Providers’ vehicles have installed cameras. This camera records area outside of the vehicle and the purpose of recording is providing security of both the Users and the Service Providers; protection of the vehicles from theft and vandal behavior; as well as protection of the vehicle in the case of an accident.

While the Service Providers are controllers in this situation, CAR:GO is just a recipient. More info on cameras and its use is provided in the vehicles.

F. Your transaction details

On the behalf of both the Merchants and the Service Providers, we process data on transactions you perform through the CAR:GO App,
including time of your transaction, the App fee, GPS data. This data is available to you at any moment, since you have the right
to access to this info. In this case, CAR:GO is a processor and the Merchants and the Service Providers are controllers, respectively.

G. Payment in the name and for the account of the Service provider/Merchant (payment card information)

For services rendered via the CAR:GO App you can pay using a payment card. Namely, as stated in the General Terms of Use, CAR:GO charges
in the name and for the account of the Service Provider/Trader. Accordingly, all data that is processed in connection with such payments,
CAR:GO processes as a processor hired by the Service Providers/Merchants.

Data from payment cards is sent directly by users to one of the payment services that are PCI/DSS compliant, all through the CAR:GO App
which hired that service. Therefore, CAR:GO does not directly process or store payment card data.

In order to prevent various abuses related to payment activities, CAR: GO uses anonymized data from the payment card – hash payment card
obtained by irreversible encryption. The anonymized data obtained in this way is used only for the validation of that same card in the future.
When someone tries to add a new payment card, a new hash is created and if it matches an existing one – the system reports that it is not
possible to register that payment card. In that case, it is necessary to contact us via the following email address: [email protected]
Please note that this is the processing of anonymized data and that CAR:GO cannot in any way identify any user based on this data.

Personal information we get from third parties

From time to time, CAR:GO receives personal data about individuals from third parties. This may happen if you are the employee of an organization which uses the CAR:GO Service and signs you up for the using of the CAR:GO Service.

What happens if you don’t give us your data?

In order to enable you to use the CAR:GO App and to authenticate you so that we know it is you and not someone else, we need your personal data. Otherwise, it is not possible to use the CAR:GO App.

6. Purpose and Lawfulness of Processing

In general, we will process personal data where the processing is required to conclude and execute a contract with you (Terms and Conditions CAR:GO). In certain situations, we may process your personal data when that processing is necessary for compliance with a legal obligation or when processing is necessary in order to protect your vital interests. If we process your personal data on the basis of our legal obligation or for the protection of your vital interests, we will notify you. We may also process your personal data in order to realize our legitimate business interest.

We will only use the personal data that we need for a particular purpose and we will always try to limit the use of your personal data in relation to what is necessary for that purpose. The purpose of processing your personal data is to register on the CAR:GO App and use all its benefits.

By agreeing to the Terms and Conditions CAR:GO you are entering into a contract with us. We process your personal data for the purpose of concluding and executing said contract.

In addition to this, we may process your personal data in order to send you a newsletter with pertinent information about the special CAR:GO offers. When sending a newsletter, we will do that with either your consent, or by relying on our legitimate interest.

7. Legitimate Interest of the Controller

In order to achieve our business purpose, we process your personal data based on a legitimate interest. Of course, we do this only if
your interest or your fundamental rights and freedoms do not prevail over our legitimate interest.

Our legitimate interest to use your personal data is necessary in the following situations:

  • To service your account, manage complaints and resolve any disputes;
  • To promote and market our products and services;
  • To protect the rights, property, or safety of CAR:GO, our members, or others;
  • To protect our business operations and provide support to our members, partners and colleagues;
  • To identify and prevent fraud and other illegal acts;
  • To test and develop new services and products or improve current ones.

You can at any moment object to the processing based on our legitimate interest by sending an email to us at [email protected]

8. Push notifications

Push notifications are messages that appear on your mobile phone device. Push notifications appear on mobile phone devices outside of applications and are used for various purposes: smoother operation of applications, notification of changes/news, notification of promotions, etc. CAR:GO also uses push notification technology for three purposes.

The CAR:GO App uses push notifications to make the application work and to inform you about the provision of CAR:GO and Butler services. Namely, with a push notification, we inform you whether a Service Provider is free, how long it takes them to arrive, where the Service Provider/Merchant is currently located, etc. The CAR:GO App would not be able to function without the push notification option enabled and in case the push notification is turned off you would not be able to see the available Service Providers, or when the Service Provider/Merchant is arriving etc.

We use push notifications to inform you of the system information about the CAR:GO App itself (notification of regular updates of the CAR: GO App; notification of delays, etc.).

CAR:GO uses push notifications to inform you about the latest promotional offers, news, etc. If you do not want to receive promotional messages via push notifications, you can withdraw your consent to the option of receiving advertising messages via push notifications at any moment by turning off the option of sending notifications for the CAR:GO App in your phones settings option. This is not an ideal solution, but the operating systems (Android, iOS) did not allow for the purpose for push notifications to be separated as such. Please note that if you decide to turn off the option for receiving push notifications (in order to disable advertising messages) due to the explained system functionalities, you will not be able to use the CAR: GO App. If you have difficulty disabling promotional push notifications on your mobile phone device, you can contact us at any time by sending an email to the following e-mail address: [email protected] In any case, we will react immediately and stop processing.

9. Recipients of Personal data

Your personal data is shared internally during the course of maintaining the CAR:GO App. In addition,
we may share your personal data with the following:

  • Subcontractors, external consultants, lawyers, bookkeepers, commercial banks, and other third parties such as:
    o IT cloud, hosting, infrastructure and support providers;
    o Marketing and advertising service providers;
  • A newly established entity or entity acquiring ownership of CAR:GO,
    if CAR:GO is involved in a merger, acquisition, purchase, sale of shares or other status change;
  • Any other recipient, if we are required to do so, such as by an applicable court order or law;
  • Any other recipient when reasonably necessary, such as in the case of a life-threatening situation.

All of the recipients are required to have appropriate technical and organizational measures in order to ensure the protection of your personal data and your rights. CAR:GO has entered into data processing agreements with all of its processors.

10. Transfer of Personal Data

Personal data can flow without any safeguards necessary to third countries where transferred to countries based in the EU (Austria and France), countries signatories to the Convention 108 (Serbia) and those countries that have been recognized by the EU, as having an adequate level of personal data protection. For example, we are transferring your personal data to Germany for safe storage.

If personal data is transferred to a country that is not based in the EU (Austria and France) or to a country that is not signatory to the Convention 108 (Serbia) or to a country that has not been recognized by the EU, as having an adequate protection, CAR:GO shall provide appropriate safeguards (e.g. signed standard protection clauses).

11. Storage Period

CAR:GO retains your personal data for the duration of your membership in CAR:GO and for a period of time thereafter to allow members to recover accounts if they decide either to renew their membership or to analyze their own business data within CAR:GO. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact [email protected]

12. Data Integrity

We will take reasonable steps to ensure that personal data that we process is reliable for its intended use, accurate, complete, and current.
You are responsible for the accuracy of all personal data you provide to us. We will use reasonable efforts to maintain the accuracy and
integrity of the personal data we obtain, and to update it as appropriate.

13. Security

CAR:GO takes appropriate security measures to ensure that your personal data is protected from access and disclosure not authorized through the application of this Privacy Notice.

We take appropriate physical, administrative, organizational, procedural and technical measures necessary to ensure the appropriate level of protection of the personal data being processed. CAR: GO applies the best industry standards in data protection. Protection refers to loss, misuse and unauthorized access, disclosure, alteration and destruction. However, no security measures can be guaranteed to be a 100 percent effective, nevertheless CAR:GO always uses its controlled processes and employs highly responsible individuals to regularly enhance security measures in order to protect your personal data.

14. We do not Knowingly Collect Information from Children who are Under Fourteen (14)

The CAR:GO App is not directed to minors younger than the age of fourteen (14). We do not knowingly collect personal data from minors under this age and we will delete any such data later determined to be from a young person under the age of 14, unless we have received a consent to collect such personal data from the minor’s parents or guardians. In the event a parent or a guardian believes that his/her child has provided information to CAR:GO and wishes that data to be removed or corrected, please contact CAR:GO at [email protected]

15. Your rights

You may exercise certain rights over CAR:GO in relation to the personal data we process about you. You can exercise your rights at any time.

As a data subject you have the following rights:

  • Be informed: right to know how we process your personal data (this right has been met by providing you with this Notice).
  • Access: request access to your personal data we process. If your request to us for access to your data is in electronic form, we will respond in the same way, unless you request a different response.
  • Rectification: ask to have inaccurate personal data held about you rectified without undue delay or to have incomplete personal data completed. Please notify us if your personal details change or if you become aware of any inaccuracies in the personal data that we hold about you.
  • Erasure: request erasure of your personal data (except to the extent as may be limited, excused or prohibited by the applicable law) without undue delay.
  • Data Processing Restriction: request that we restrict processing of your data in certain situations.
  • Object to the processing of your personal data: object to specific processing of personal data, including direct advertising, processing for scientific or historical research purposes or for statistical purposes.
  • Request data portability: should the processing of your personal data be carried out by automated means and that data was provided based on consent, or the processing is necessary for the performance of a contract, and should you request it, we will (i) provide you with the data in a structured, commonly used and machine-readable format and, (ii) allow the transmission of the data to another data controller.

Access to your rights will be provided at no cost by email at [email protected] We shall provide you with the action taken without undue delay and in any event within 30 days of receipt of the request. That period may be extended where necessary, taking into account the complexity and number of the requests. This period cannot be longer than 90 days and we will inform you about it separately. If for some reason access is denied, CAR:GO will provide an explanation as to why access has been denied.

In case you consider that any of these rights is not respected or that we act against the law, please contact us by email at [email protected] In any case, you can also file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

16. Consent and withdrawal

You can withdraw the consent for the processing of your personal data that you have given to us at any time.
We will act on it immediately and stop the processing. This is free of charge.
You can send us the request for withdrawal at [email protected]
   
CAR:GO ASSOCIATION PRIVACY NOTICE

1. Effective Date

This Privacy Notice (Notice) has been issued on April 20th, 2019.

2. The purpose of the Notice

Transparency and care about your personal data are core values on which we base the work of our “CarGo” Association. We process your personal data so that we could enable you to become a member of our “CarGo” Association. Membership is free for all natural and legal persons who accept the membership form and who want to make use of the communication and transactions between members by electronic means and software, approved by the Board of Directors of the “CarGo” Association, which allows easier mediation of the Association between its members (App).

The intention of this Notice is to inform you about the way we at “CarGo” Association deal with your personal data. It explains how we collect, store or otherwise process personal data for the purpose of enabling you to become a member of our Association. This Notice is issued in alignment with the General Data Protection Regulation (GDPR) and the Personal Data Protection Act in Serbia (PDPA).

“CarGo” Association supports your data protection rights enabled by GDRP and PDPA. We believe that individuals should have the right to control their data, regardless of their physical location.

By personal data we mean any information relating to an identified or identifiable natural person, such as a name, age, a photograph, or location data. Personal data does not include information that is anonymized.

Processing means any operation or set of operations which is performed on personal data, or on sets of personal data (such as collection, recording, storage, adaptation or alteration, erasure or destruction).

3. Changes and amendments

This is the last version of this Notice (August 19th 2021).

Should this Privacy notice be updated or modified in a material way, we will update the last changes date of this Notice.
In addition, we will announce and provide a notice about the new version of the document.

4. About Us

In this Notice “CarGo” Association, “Association”, “CarGo”, “we” and “our” refers to ASSOCIATION “CarGo”, with its
registered seat at street Vojvode Stepe no. 18 loc. 1, Belgrade – Vozdovac, Republic of Serbia. The “CarGo” Association
is a non-governmental, non-political and non-profit association, founded for an indefinite period of time in order to
achieve goals in the field of development of smart transport in smart cities and protection of the natural environment.

“CarGo” Association is a controller during the processing of your personal data, which we shall elaborate further below.

Any questions, complaints, requests for exercising your rights and additional information regarding the Notice and personal
data protection at “CarGo” Association can be obtained at the following e-mail address: [email protected] .

We have appointed a data protection officer (DPO), who is responsible for ensuring that “CarGo” Association processes
your personal data in accordance with the valid legislation. Aleksandar Vučić is our DPO and you can reach him at:
[email protected] .

5. Personal Data We Collect

Personal data you give to us

A. Membership in the “CarGo” Association

A necessary condition for joining the “CarGo” Association is to go through the membership process. On that occasion,
you need to download the App located on the official website of the “CarGo” Association, then enter your data in the
App, after which you will receive an application form that you need to accept electronically (Membership procedure).

Going through the Membership procedure to join the “CarGo” Association, we collect information about you, including,
but not limited to your name and surname, email address, your mobile phone number. The App can also collect your photo.
The “CarGo” Association is the controller during the processing of your data in connection with the membership in the “CarGo” Association.

We process your personal data for the purpose of joining the “CarGo” Association, in order to provide you with membership benefits and inform you about the possibilities related to your membership in the “CarGo” Association.

B. Administration of the “CarGo” Association Members

We use your personal data during regular activities related to the administration of membership in the “CarGo” Association, so that all data is accurate and up-to-date. In this case also, the “CarGo” Association is the controller during the processing of your personal data.

Personal information we receive from third parties

We may receive your personal information from third parties from time to time. This can happen if you are employed by a company that wants to apply for membership in the “CarGo” Association in order to provide you with smart transportation.

What happens if you don’t give us your details and don’t go through the Membership Procedure?

In order for you to become a member of the “CarGo” Association and for us to identify you so that we know that it is you and not someone else, a necessary condition is that you have gone through the Membership procedure and on that occasion, we need your personal information. Otherwise, if for any reason you do not want to go through with the Membership procedure, or if on that occasion you do not want to leave some of your personal information that we deem necessary, it is not possible to become a member of the “CarGo” Association.

6. Purpose and Lawfulness of Processing

Innately, we process your personal data if such processing is necessary during the Membership procedure, and based on your accession
to the Statute of the “CarGo” Association (membership form which is to be accepted electronically). The Statute of the Association
represents the contract of all members of the Association, in which sense, by joining the Statute of the “CarGo” Association, you sign
a contract with CarGo, based on which your personal data is processed.

Also, in certain situations, we may process your personal data when that processing is necessary for compliance with a legal obligation or when processing is necessary in order to protect your vital interests. If we process your personal data on the basis of our legal obligation or for the protection of your vital interests, we will notify you. We may also process your personal data in order to realize our legitimate business interest.

We will only use the personal data that we need for a particular purpose and we will always try to limit the use of your personal data.
The purpose of processing your personal data is to facilitate your membership with the “CarGo” Association through the Membership
procedure and further use of all membership benefits.

By accession to the Statute of the “CarGo” Association you are entering into a contract with us. We process your personal data for the purpose of entering and performing that contract.

In addition to this, we may process your personal data in order to send you a newsletter with pertinent information about the special “CarGo” Association offers. When sending a newsletter, we will do that with either your consent, or by relying on our legitimate interest.

7. Legitimate Interest of the Controller

In order to achieve the statutory goal of our Association “CarGo”, we process your personal data based on legitimate interest.
Of course, we do this only if your interest or your fundamental rights and freedoms do not outweigh our legitimate interest.
We use a legitimate interest to:

  • To protect the rights, property, or safety of “CarGo” Association, our members, or others;
  • To protect our business operations and provide support to our members, partners and colleagues;
  • To identify and prevent fraud and other illegal acts;
  • To promote benefits which are available to the members of our Association (legal entities);

You can at any moment object to the processing based on our legitimate interest by sending an email to us
at: [email protected] .

8. Recipients of Personal data

Your personal data is shared internally within the “CarGo” Association, during the regular activities of the “CarGo” Association.
We may also share your personal information with the following recipients:

  • An application that acts as a service provider in the technical enabling of the Membership procedure, as well as the storage of your data;
  • Subcontractors, external consultants, lawyers, bookkeepers, commercial banks, and other third parties such as:
  • IT cloud, hosting, infrastructure and support providers;
  • A newly established entity or an entity acquiring ownership of the “CarGo” Association, if the Association
    is involved in a merger, acquisition, division or general status change;
  • Any other recipient, if we are required to do so, such as by an applicable court order or law.
  • • Any other recipient when reasonably necessary, such as in the case of a life-threatening situation.

All of the recipients are required to have appropriate technical organizational and personnel measures in order to ensure
the protection of your personal data and your rights. “CarGo” Association has entered into data processing agreements
with all of its processors.

9. Transfer of Personal Data

Personal data can flow without any safeguards necessary to third countries when transferred to countries based in the EU,
countries signatories to the Convention 108 (Serbia) and those countries that have been recognized by the EU, as having an
adequate level of personal data protection.

If personal data is transferred to a country that is not based in the EU or to a country that is not signatory to the Convention
108 or to a country that has not been recognized by the EU, as having an adequate protection, “CarGo” Association shall provide
appropriate safeguards (e.g. signed standard protection clauses).

10. Storage Period

“CarGo” Association retains data for the duration of your membership with “CarGo” Association and for a period of time thereafter
to allow members to recover accounts if they decide either to renew their membership. For more information on where and how long
your personal data is stored, and for more information on your rights of erasure and portability, please contact us at the following
email address: [email protected] .

11. Data Integrity

We will take reasonable steps to ensure that personal data that we process is reliable for its intended use, accurate, complete
and current. You are responsible for the accuracy of all personal data you provide us. We will use reasonable efforts to maintain
the accuracy and integrity of the personal data we obtain, and to update it as appropriate.

12. Security

“CarGo” Association takes appropriate security measures to ensure that your personal data is protected from access and disclosure
not authorized through the application of this Notice.

We take reasonable physical, administrative, organizational, procedural and technical measures necessary to ensure the appropriate
level of protection of the personal data being processed. “CarGo” Association applies the best industry standards in data protection.
Protection refers to loss, misuse and unauthorized access, disclosure, alteration and destruction. Unfortunately, no security measures
can be guaranteed to be a 100 percent effective. However, “CarGo” Association always uses its controlled processes and with high
responsibility regularly enhance security measures in order to protect your personal data.

13. Your rights

You may exercise certain rights over “CarGo” Association in relation to the personal data we process about you.
You can exercise your rights at any time.

As a data subject you have the following rights:

  • Be informed: right to know how we process your personal data (this right has been met by providing you with this Notice).
  • Access: request access to your personal data we process. If your request to us for access to your data is in electronic form, we will respond in the same way, unless you request a different response.
  • Rectification: ask to have inaccurate personal data held about you rectified without undue delay or to have incomplete personal data completed. Please notify us if your personal details change or if you become aware of any inaccuracies in the personal data that we hold about you.
  • Erasure: request erasure of your personal data (except to the extent as may be limited, excused or prohibited by the applicable law) without undue delay.
  • Data Processing Restriction: request that we restrict processing of your data in certain situations.
  • Object to the processing of your personal data: object to specific processing of personal data, including direct advertising, processing for scientific or historical research purposes or for statistical purposes.
  • Request data portability: should the processing of your personal data be carried out by automated means and that data was provided based on consent, or the processing is necessary for the performance of a contract, and should you request it, we will (i) provide you with the data in a structured, commonly used and machine-readable format and, (ii) allow the transmission of the data to another data controller.

Access to your rights will be provided at no cost by email at [email protected] . We shall provide you with the action taken without undue delay and in any event within 30 days of receipt of the request. That period may be extended where necessary, taking into account the complexity and number of the requests. This period cannot be longer than 90 days and we will inform you about it separately. If for some reason the access to your rights is denied, we will provide you with an explanation as to why access has been denied.

In case you consider that any of these rights is not respected or that we act against the law, please contact us by email at the following email: [email protected] You can also, at any time, file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

14. Consent and withdrawal

You can withdraw the consent for the processing of your personal data that you have given to us at any time. We will act on it immediately and stop the processing. This is free of charge. You can send us the request for withdrawal at the following email address: [email protected] .