1. Overview

We respect and protect your privacy. This Privacy Policy sets out how we collect, use, disclose, process, manage and transmit personal information, and also informs you of your privacy rights. This applies to mobility services which can be booked through the alpaca app or partner apps.

Unless otherwise specified below, we are data controller for the personal data collected from users within the European Economic Area. We have appointed a data protection staff who can be reached at germany@maasasia.com or at one of our postal addresses. "We" are a private limited liability company registered under the laws of the Federal Republic of Germany, and "you" are a person requesting vehicle rental service through the alpaca app account or a rider of the vehicle.

2. Definitions

1. In this Privacy Policy, “service” refers to the following:

2. This Privacy Policy aims to inform you of the types of information we may collect while you use the service and other related interactions, how we use your information, when we may disclose your information, and how we collect your information, and your rights and options regarding our collection and processing of the information.

3. This Privacy Policy includes the following.

3. Information We Collect

We collect information relating to the service and interactions directly from the user, and from third parties when necessary as well as from the user. We may combine the information we collect from these different sources.

1. The information you provide to us is as follows:

2. The types of information we collect directly from you are as follows:

3. Automatically collected information. When you browse our website, or use our apps or other services, we collect information through automated and technical means.

4. Information collected from third-party sources. In some cases, we collect user information from third parties.

4. Use and Processing of Information on the Basis of EU Law

To improve our service as detailed below, we generally use personal information to provide and operate our service, to respond to user requests, to receive customer service and support, and to protect our and others’ rights. We also use it to help transmit marketing communications, personalize user experiences and improve our service.

1. Legal basis for processing in accordance with EU law. When EU data protection law applies, we process your personal data as defined in applicable EU law for the purposes set out in the table below upon the following legal basis:

2. Contract with you. When our processing is necessary to perform our obligations under a contract with you or to carry out steps requested by you before entry into a contract with you (the purpose of verifying the information you have provided to us and providing you with appropriate services).

3. Our legitimate interests. When our processing is necessary for our legitimate interests such as protecting our service security, protecting others’ health and safety, establishing, protecting and defending our legal rights, monitoring and safeguarding our vehicles, preventing fraud, verifying the user’s identity and rights, and personalizing user experience. It also helps understand and analyze usage trends and improve our service.

4. Legal compliance. When our processing is necessary to comply with applicable laws, e.g., maintaining transaction history for tax reporting purposes

5. Your consent. With your consent as defined in applicable laws, we may process information to the extent necessary to protect personal health, safety or materials interests and establish, protect and defend legal rights.

5. Provision of Personal Information to Third Parties

When providing a third party with personal information lawfully collected from the information subject, we check the legal basis of lawful provision of personal information in advance and comply with necessary procedures. If necessary, we may enter into a city-by-city partnership in Europe to provide user information to the relevant company, where prior consent from the information subject shall be obtained.

6. Purposes of Use and Processing

Generally, we use collected information as set out in the table below.

7. Disclosure of User Information

We disclose the collected information as follows:

1. Affiliates and subsidiaries

2. Business partners and third parties

3. Third-party service providers. NAT uses various third-party service providers that perform, on its behalf, functions such as hosting, billing and payment processing, push notifications, storage, bandwidth, content management tools, analytics, customer service, anti-fraud, app functionality, etc.

4. General business. If necessary to administer our general business, accounting, record-keeping and legal functions, please contact tax advisors, legal advisors and other professional service agencies or agents.

5. Compliance with laws and protection of rights. We may also use or disclose information if we are required to do so by law or (a) by good-faith belief that we are required to do so to comply with the laws applicable to us or with the legal process provided to us. (b) protect our rights or property, services, or users, including investigation, prevention, or action. Matters on illegal activity, suspected fraud, potential threat to personal safety, violation of our Terms of Service, rental agreements, other agreements or policies, or evidence of litigation involving us and (c) act in emergency situations to protect the personal safety of us, our affiliates, agents, or users of the services or the public. This includes exchanging information with other companies and organizations to prevent fraud.

6. Other users. Some features of our service allow you to share your comments publicly with other users. All information submitted through these features is non-confidential and may be accessible to other users.

7. Aggregate/anonymous Information. For research, marketing, analytics and other purposes, we may share aggregate/anonymous information about your use of the service with third parties. However, if such information does not identify a specific individual (e.g., publishing a report on usage trends), its sharing is not restricted.

8. Business transfer. As we continue to develop our business, we may acquire, merge with, or seek partnerships with other companies. In such transactions, user information may be included in the transferred assets, and if some or all of the assets are sold or transferred to a third party, customer information is likely to be one of the transferred business assets. If such transfer is subject to additional mandatory restrictions under applicable laws, we will comply with the restrictions. For more information about the companies to which we have disclosed your information, please contact us as specified in the "Contact Information" section.

8. Use of Cookies and Other Online Tracking Technologies

1. Like most websites, apps and online services, we use "cookies" to record the user’s preferences, collect information about your use of our service, personalize content and advertising, and track information on advertising performance. We may also use these technologies to monitor traffic and to make it easier and more effective to use our service. We may combine this information with other information collected from you.

2. Cookie. This is an alphanumeric identifier sent to your device’s hard drive via your web browser for record-keeping purposes and is associated with a small text file used to record information about online services, user’s preferences and actions, and devices and usage data. Some cookies make it easier for the user to navigate our website, apps and services, while others enable a faster log-in process, personalize your use of our service, or track the user’s activity while using our service. Most web browsers automatically accept cookies, but you can usually modify your browser settings to reject or block cookies if you want it. If you delete cookies or set your browser or device to reject or block these technologies, some features of the service may stop working or may not work as designed.

3. Analytics service. We use third-party analytics services, including Google Analytics (a web analytics service provided by Google, Inc. ("Google"), on our service. Google Analytics uses cookies and other tracking technologies to help analyze how the user interacts with and uses our service, compile reports on the user’s activity, and provide other services related to the user’s activity and usage. The technologies used by Google may collect information such as the user’s IP address, visit times, whether he/she is a visitor, and referral websites or apps. In addition, through the Amplitude analytics service, we can analyze user behavior by collecting the user’s IP address, visit status, app number or device information, etc. For more information on the use of cookies, third-party analytics, and other tracking devices, please see our cookie notices.

9. Online Advertising

1. To display more relevant advertising on our service, to manage our advertising on third-party websites, mobile apps and online services, and to measure and improve our advertising and marketing efforts, we may work with Facebook, Google and other third-party advertising companies, advertising exchanges, channel partners, measurement services and advertising networks. For more information, please see our cookie notices.

2. These third parties may use cookies or other tracking technologies to collect information about the user’s use of the service and activities on other websites and online services, and such information can be connected to permanent identifiers. This information may be used to deliver more relevant advertising or other targeted content on our service and other websites or services and to measure the performance of such advertising. Your activities and your options related to the use of your information for your personalized advertising are governed by the relevant company’s policies.

3. Additional Information. For more information and options regarding advertising, see the following.

4. No tracking. Your browser or device may contain “do not track” settings or features. Currently, our systems do not recognize "do not track" requests from browsers. Our information collection and disclosure practices and the options we offer our customers will continue to operate as described in this Privacy Policy regardless of whether we receive a “do-not-track” signal.

10. How to Protect Your Information

To protect your information from accidental or unlawful destruction, accidental loss or alteration, or unauthorized disclosure or access, we employ technical, physical, and organizational security measures. However, no method of transmission over the Internet or means of electronic or physical storage is secure. Log off after using a shared computer, choose a strong password that no one knows or can easily guess, protect your information by keeping your login IDs and passwords private, and prevent unauthorized access to your passwords or accounts. We are not responsible for any activity on your account via lost, stolen, or compromised passwords or unauthorized password activity.

11. Retention of Your Information

Unless a longer period is necessary to establish, protect or defend our legal obligations or legal claims, we will retain your information for as long as necessary to satisfy the purposes of collection and use (e.g., period necessary to provide customer service, answer questions or resolve technical issues).

12. Overseas Users

We are a global company with affiliates, service providers, and partners in many locations. As such, your information may be transmitted, accessed, stored, and otherwise processed by us and these third parties for the purposes described above and in jurisdictions outside your home jurisdiction (including Asia, European Economic Area and other jurisdictions) at the request of law enforcement agencies. By providing your information, you authorize such transmission, storage, or use. We will take steps (including appropriate written data processing terms and services and data transmission agreements) to ensure that your information receives an adequate level of protection in the jurisdictions in which we process the information.

13. Third-Party Links and Services

The service contains links to third-party websites, such as social media sites, and also includes third-party plug-ins and features (e.g., Facebook’s "Like" buttons and Twitter’s "Follow" buttons). If you choose to use these sites or features, we may disclose information to relevant users and the public as well as to third parties depending on how the service operates. We are not responsible for the content or practices of these websites or services. The collection, use, and disclosure of user information are governed by the privacy policies of third-party websites or services, not this Privacy Policy. Please read the privacy and security policies of the third parties.

14. Changes to this Privacy Policy

We may amend this Privacy Policy at any time to reflect changes in law, data collection and use practices, functionality of the service, or technological advances. We will make the amended Privacy Policy accessible through the service and update the Privacy Policy's effective date. If we make material changes to this Privacy Policy, you will receive appropriate notice in accordance with legal requirements. By continuing to use the service, you confirm that you have read and understood the current version of this Privacy Policy.

15. Options

If you would like to update your preferences for the types of communications you receive from us or to opt out of marketing communications from us, you may update your communication preferences in your account profile at any time. We may continue to send you non-promotional communications such as important announcements, payment confirmations, transaction-related emails, and other information about your use of our service. If you do not wish to participate in (a) marketing communications or (b) personalized campaigns (See “Online Advertising” section above), you may cancel your request by sending an email to germany@maasasia.com.

16. Your Rights and Options

Depending on the user’s location, local laws may give you the following rights in relation to the user’s information.

1. Request access to, and/or copies of, certain information about you

2. Obtain a copy of certain information about you in a machine-readable, structured format commonly used in the specific circumstances and, where technically feasible, request that it be transmitted to a third party.

3. We hold outdated or incorrect information to request that we update your information.

4. Request us to delete certain information we retain about you.

5. Request us to limit how we process and disclose your information.

6. Withdraw your consent to the processing of your information to the extent that our processing is not based on any other legal basis.

7. Object to the processing of certain information, such as:

You may contact us at any time by email or phone using the contact details specified in the "Contact Information" section below to request the information we retain or request additional information about your legal rights. We will respond as quickly as possible. Your rights may be exercised through a legal representative or agent. When you request access to or correction, deletion or restriction of certain information we retain about you, we first verify that the person making the request is actually you or your authorized representative. You can also access and correct most of the information you have submitted, by logging into your account and updating your profile. Copies of the information updated, corrected, or deleted will be available for a certain period in the cached and archived pages of the website or app. We may also retain certain information about you as required by law or as permitted by law for legitimate business purposes. For example, if we believe you have violated our Terms of Service, we may retain your information to resolve the issue before deleting it. In addition, we may not investigate other persons’ or entities' information.

We will consider all requests and provide responses within the time specified by applicable law. We may also ask you to provide us with the information necessary to verify your identity, before responding to your request.

In the case of a complaint, you may file a complaint with the privacy regulator or supervisory authority in the country in which you reside. Alternatively, if you believe that your rights have been violated, you may seek remedies through the local courts.

17. Contact Information

If you have any questions about this Privacy Policy, wish to exercise any of your rights regarding the information we retain about you, or make a complaint to us regarding your information, you may contact us at: