This privacy notice describes how Chariot Transit UK Limited ('we', 'us') collects and processes personal data about you; how we use and protect this data, and your rights.

It applies to all personal data we collect or process about you. Personal data is information about you, and which on its own or combined with other information can identify you.

Personal data we use

We collect personal data about you from a variety of sources, directly from you (e.g. when you sign up for an account), and from other sources, including social media sites. We may also generate information about you based on your use of our services.

We may be required to collect certain personal data about you in order to carry out our obligations under the Terms of Use of our website or app, such as payment information which we need to complete your booking. If you do not provide this information, it may prevent or delay the fulfilment of these obligations.

Information we collect directly from you

The categories of information that we may collect directly from you include the following:

• personal details (e.g. name and password);
• contact details (e.g. phone number, email address and postal address);
• payment details (e.g. billing and credit card information);
• location information from your device, which we will only collect after you have given your explicit consent. (NB we also track the location of Chariot vehicles, including when you are using them);
• other information about your device and your access to our website or app (e.g. device ID, IP address, browser type, time of access to website or app, and pages visited). See our Cookie Policy for further information to this;
• CCTV images of you on our vehicles; and
• content of feedback you provide to us and information you input on our website or app (e.g. via message boards or feedback forms).

Information we collect from other sources

The personal data we may collect from other sources consists of your social media details (e.g. Facebook ID, Twitter username, Google login details) and feedback made on social media platforms (e.g. photos and text from Twitter and Facebook).

Other information we use about you

We may generate further personal data about you, which may include:

• Usage information (e.g. history of your use of the service, including the specific journeys you have taken);
• Details about your preferences (e.g. favourite origins and destinations, favourite routes);
• Advertising profiles (e.g. advertising IDs from mobile devices).

How we use your personal data and the basis on which we use it

We may use your personal data for the purposes described below. We are required to have a legal basis for each use your personal data which is also described below. In addition to these legal bases, where we collect your personal data on the basis of your consent as described above, we will use it on the basis of that consent. Where you have given your consent, you can withdraw it at any time either within the app or by using the contact details set out below:

• Identification and authentication: we use your personal data to verify your identity when you log in to your account, in order to comply with our contract with you set out in the Terms of Use.
• Operating the services: we use your personal data, including location details and payment details, to provide you with services you have requested, in order to comply with our contract with you set out in the Terms of Use.
• Ensuring our services our secure: CCTV cameras are installed on all our vehicles, and the images captured are used to meet our legitimate interests in preventing and deterring crime on our vehicles and ensuring that our passengers are kept safe.
• Improving our services: we analyse information about how you use our services to provide an improved experience, for example to analyse usage of different routes or to determine which routes could be changed. We do this to meet our legitimate business interests in understanding where our service is most popular and to provide the most useful routes for our customers.
• Communicating with you: we may use your personal data when we communicate with you, for example if you contact us with questions or feedback about the service. It is in our legitimate interests that we are able to provide you with appropriate responses and provide you with information about our services when you need it.
• Exercising our rights: we may use your personal data to exercise our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims or violations of law or the Terms of Use.
• Marketing: we may use your personal data to personalize advertising which you may see on our website or app, as it is in our legitimate business interests to make these adverts more relevant and interesting. We may also send you marketing messages where we are permitted by law to do so, which may be on the basis of our legitimate interests in letting you know about available products or services or, if required by law, on the basis of your consent.

Information Sharing

We may share your personal data with third parties under the following circumstances:

• Service providers and business partners: We may share your personal data with companies that perform services on our behalf. For example, we may partner with companies who will host our data and our website, provide payment services and analytics providers. We use these service providers where necessary for the purposes set out above and on the same basis as set out above.
• Group companies: We are owned by Ford Motor Company, and we work closely with other businesses and companies that are part of the Ford family. We may share the personal data we collect from you with Chariot Transit, Inc. and other members of the Ford group of companies, which may carry out their own analysis of the personal data we collect to understand and improve their own services. We take steps to make sure these Group companies will not use your personal data in ways which are incompatible with the purposes set out above. Please visit the Ford Motor Company website for more information about how Ford may use your personal data.
• Law enforcement and other government agencies: We may share your personal data with these parties where we believe it is necessary to comply with legal obligations, to protect our rights or to protect the rights of any third party.
• Asset purchasers: We may share your personal data with any third party that buys, or to which we transfer, all or some of our assets and business. In this case, we will make efforts to ensure that the buyer uses it in a manner that is consistent with this Privacy Policy.

Your Rights Over Your Personal Information

You have certain rights regarding your personal data, subject to laws where you live. These include the rights in certain circumstances to:

• access your personal data;
• correct the personal data we hold about you if it is wrong or out of date;
• have your personal data deleted;
• restrict our use of your personal data;
• object to our use of your personal data; and
• receive your personal data in a usable electronic format and transmit it to a third party (the right to 'data portability').

We encourage you to contact us to update or correct your personal data if it changes or if it is inaccurate, for example if you change your name or address. You can change certain details by signing into to your account and clicking on the 'My Account' section of the Website or the ‘Profile’ section of the App.

Please note that we will likely require additional information from you in order to honour your requests.

If you would like to discuss or exercise such rights, please contact us using the details below.

Information Storage

We will keep your personal data for as long as we have a relationship with you, for example as long as you have an account with us or use our services through a work account. When deciding how long to keep your personal data after our relationship with you has ended, we take into account our legal obligations and regulators' expectations. We may also retain records to investigate or defend potential legal claims.

Transferring Data out of Europe

Your personal data may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal data under European Union law.

We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

Contact Us

Chariot Transit UK Limited is the controller responsible for the personal data we collect and process.

If you have questions or concerns regarding the way in which your personal data has been used, please contact [email protected].

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the data protection authority of the UK, the Information Commissioner's Office, using their website.

Changes to the Policy

You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update this privacy notice from time to time. You will be able to see when we last updated the privacy notice because we will include a revision date. Changes and additions to this privacy notice are effective from the date on which they are posted. Please review this privacy notice from time to time to check whether we have made any changes to the way in which we use your personal data.