Privacy Policy

1 About this Privacy Policy

This Privacy Policy explains how GoCimo collects, uses, analyses, retains and shares personal data in connection with vehicle rental and subscription services, battery swapping, applications, websites, fleet and delivery services, advertising, analytics and commercial data services. It applies to customers, authorised drivers, business contacts, prospective customers and other individuals whose data we process, including drivers using vehicles through an employer, delivery platform or other organisation. It also applies to visitors and other people whose images are captured by GoCimo’s camera surveillance at the locations described in Section 5.14.

We use data to provide, operate, protect, analyse and improve our services, locate and protect Vehicles, reduce operating costs, support safe driving, administer partner benefits and commercial partnerships, provide services and reporting to business partners, and develop and commercialise advertising, analytics and data products as described in this Policy. The particular processing depends on the service, equipment and choices involved. Listing a purpose in this Policy does not mean that every category of data is used for every purpose or that every optional service is active for every user.

This Policy provides information; accepting it or continuing to use a vehicle is not consent to optional processing. Separate notices and choices are provided where required. We process personal data only for specified purposes with an applicable lawful basis. This Policy does not transfer ownership of personal data or waive statutory rights.

For this Policy: “Customer” means an individual who registers for, books, rents, subscribes to, uses or is authorised to use a GoCimo service; “Account” means the Customer account or other user profile used to access or administer the Services; “Rental Agreement” means an agreement for the rental, subscription or other authorised use of a Vehicle or related service; “Vehicle” means a moped, motorcycle, bicycle, cargo vehicle or other vehicle made available through GoCimo; “Battery” means a removable or installed traction battery used with a Vehicle or GoCimo battery-swapping service; “Top-Up” means a monetary or service credit, balance addition or similar benefit added to an Account by GoCimo or a participating partner; “Partner Benefit” means a benefit, discount, credit, Top-Up or other advantage offered to Customers by or through GoCimo in cooperation with a participating food-delivery, logistics or other business partner; “Wallet” means the in-App balance and payment functionality described in the Terms and Conditions, through which a Customer may hold, receive, add, use or administer Top-Ups, credits, Partner Benefits and other balances; “pseudonymised data” means personal data that can no longer be attributed to a specific individual without additional information that is kept separately, and that remain personal data; and “anonymised data” means information that does not relate to an identified or identifiable individual, or that has been rendered anonymous so that the individual is not or is no longer identifiable, taking into account the means reasonably likely to be used for re-identification. “GoCimo” means the GoCimo entity acting as controller for the relevant processing and, where Group Processing applies, includes GoCimo Group AB as described in Section 2. “Group Processing” means processing carried out through GoCimo’s group-wide systems or for group-level analytics, reporting, service development, operational optimisation, commercialisation or other purposes described in Section 2. “Authorised Driver” means a person authorised to use a Vehicle under a Customer, employer, fleet, platform or other business arrangement, whether or not that person is the contracting party. “Services” means the vehicle, battery, swapping, digital, fleet, delivery, support and related services described in this Policy.

2 Data Controllers and Scope

The responsible GoCimo entity is identified in the table below and in the relevant service agreement or specific notice. A branch is generally not a separate legal entity; the legal entity operating the branch remains responsible. Group membership alone does not make every GoCimo company a controller of all data.

GoCimo Entities and Controller Roles. Depending on the processing activity, a GoCimo entity may act as an independent controller, a joint controller with another GoCimo entity, or a processor acting on behalf of another GoCimo entity.

Each operating GoCimo entity generally acts as an independent controller for processing relating specifically to its own Customer relationships, Rental Agreements, local operations and legal obligations.

For Group Processing, including processing through GoCimo's group-wide systems and data platform for group-level analytics and reporting, fleet and operational analysis, service and product development, maintenance and repair optimisation, safety and driving-behaviour analysis, fraud and misuse prevention, advertising measurement and verification, preparation of reports for customers, advertisers and commercial partners, and data sharing with partners and other recipients as described in this Policy, GoCimo Group AB and the GoCimo entity providing the relevant Services act as joint controllers under Article 26 GDPR.

Where GoCimo Group AB and a relevant operating GoCimo entity jointly determine the purposes and essential means of processing, they act as joint controllers and enter into and maintain a written arrangement under Article 26 GDPR allocating their respective responsibilities. The relevant operating GoCimo entity is primarily responsible for the collection of personal data and the local Customer relationship, while GoCimo Group AB is primarily responsible for the operation and governance of the group-wide data environment and the jointly controlled Group Processing. The allocation is reviewed where processing activities or roles materially change and does not restrict the Customer's rights under the GDPR.

Data subjects may exercise their rights against either joint controller. The essential elements of the joint-controller arrangement, including the allocation of responsibilities between the relevant GoCimo entities, are described in this Policy.

Where GoCimo processes delivery-recipient or workforce data solely on a business customer’s instructions, that customer is the controller and its privacy notice applies to those purposes. GoCimo remains responsible for processing for its own fleet, safety, billing and other stated purposes. Privacy contact: privacy@gocimo.com

3 Personal Data We Collect

3.1 Identity account and transaction data

Name, contact details, date of birth, account identifiers, employment service identifiers, food or logistic platform identifiers, language and preferences; driver’s licence details and verification results; identity-document information and national identifiers where necessary and lawful; business affiliations and authorised-driver records; booking, subscription, collection and return details; payments, deposits, Top-Ups, discounts, invoices and outstanding balances. Identity-document copies are limited to what is necessary. National identification numbers, including Swedish personal identity numbers, are processed only where specifically justified under applicable national law, including where necessary for secure identification or another legally recognised substantial reason, and are not used more broadly than necessary for that purpose.

Full payment-card data are normally handled by the payment provider. Payment services are provided through third-party payment providers, including Stripe and Adyen. Full payment-card details are normally collected and processed directly by the relevant payment provider and are not stored by GoCimo. GoCimo may receive and store payment-related information such as payment status, transaction identifiers, payment-method type, masked card details such as the last four digits, expiry information where provided, tokens or other payment references, and information relating to refunds, chargebacks and failed payments.

GoCimo may verify the Customer's identity, age, driving-licence validity and required licence category, payment method and other information necessary to determine eligibility to register an Account, enter into a Rental Agreement or use a Vehicle.

Identity verification by selfie. Where offered, the Customer can verify their identity by taking a selfie that is automatically compared with the photograph on their identity document or driving licence. This comparison creates biometric data that uniquely identifies the Customer. GoCimo does this only with the Customer's explicit consent under Article 9(2)(a) GDPR, which GoCimo requests separately before the selfie is taken.

Selfie verification is optional. The Customer can instead verify their identity manually through GoCimo Customer Support, which can be contacted through the App, or in person at a GoCimo location, without extra cost and without worse terms. If the automated comparison fails, a person reviews the case before the Customer is refused.

The Customer can withdraw consent at any time through the App or by contacting GoCimo Customer Support. Withdrawal does not affect biometric verification lawfully completed before withdrawal. If consent to biometric processing is withdrawn, GoCimo stops further biometric processing and deletes or irreversibly de-links biometric data unless another condition under Article 9 GDPR specifically permits continued processing. Withdrawal of biometric consent does not necessarily require deletion of identity-document or driving-licence images, verification results or other non-biometric identity records where GoCimo has a separate valid lawful basis and continued retention is necessary for identity assurance, account security, fraud prevention, dispute handling or the establishment, exercise or defence of legal claims. Such non-biometric records are retained only for as long as necessary for the applicable purpose and are periodically reviewed. After the Account is closed, they are deleted or anonymised after the applicable retention period unless longer retention is required or permitted by law. Verification is performed by Sumsub on behalf of and under the instructions of GoCimo; Sumsub may not use the data for its own purposes or to train its own models, except where Sumsub is independently required by applicable law to process or retain specific data. GoCimo does not use biometric data for any other purpose.

GoCimo may refuse or restrict registration, a booking, a rental or use of the Services where, for example, the Customer's identity cannot be verified, the Customer does not hold the required valid driving licence, the payment method is invalid or cannot be successfully authorised, required payments cannot be collected, or applicable fraud, security or eligibility checks are not satisfied.

3.2 Vehicle battery and station data

Vehicle, battery and station identifiers; current and historical GPS coordinates, timestamps, routes, distance and duration; speed, acceleration, braking, cornering and other driving events; ignition, locking, unlocking and parking events; battery charge, temperature, voltage, charging cycles, energy use, state of health and swapping activity; fault codes, diagnostic and sensor readings, operating mode, service history, component wear and suspected collision, tampering or unauthorised movement.

Station equipment and management systems will record the station location and ID; user, account, access-token and transaction identifiers; battery and vehicle IDs; the time of authentication, compartment opening, battery collection, insertion, return and swap completion; battery charge and temperature; energy supplied; capacity, availability, alarms and faults. These records may link a station visit or swap to an account or authorised user.

Vehicle and technical data are personal data whenever a person can reasonably be identified directly or indirectly, including through a booking, vehicle identifier, work assignment or movement pattern. Replacing a name with a code does not by itself anonymise data. Where such data are used for commercial data products, Section 5.7 explains when they are treated as personal data (Level 1) and when they have been separated from individuals (Level 2).

3.3 Delivery fleet and logistics information

Where a relevant integration is enabled, we may process the business customer, food and logistic platform or fleet account; driver or rider identifier; work or assignment status; order or consignment reference; collection and delivery locations, distance and times; estimated arrival, journey progress, service completion, downtime and charging or swapping requirements; and Top-Ups, discounts and other partner benefits. Recipient names, contact information, delivery instructions or proof-of-delivery records are processed only where needed for the particular integration. Such information may be received from business customers, food or logistics platforms, fleet customers, their service providers or systems connected to GoCimo.

We may receive data directly from food-delivery platforms, logistics platforms, merchants, fleet customers and other delivery or business partners, including through APIs, reports and system integrations.

Where a Customer requests, activates or uses a partner-benefit function, GoCimo may exchange and match limited Account, identity, platform, eligibility and transaction information with participating food-delivery, logistics and other business partners to determine eligibility for and administer partner-funded benefits, discounts, credits, Top-Ups and similar programmes. The relevant partner or partner category is identified in the service, offer or interface where required. This processing is based on the Customer's request for the relevant functionality where necessary to provide it, or on another applicable lawful basis described in this Policy.

We may match permitted partner identifiers and other data received from such partners with our Account, Vehicle, Battery and station records for the purposes and lawful bases described in Sections 5.1–5.11, where relevant and permitted by applicable law. Such matching may support, among other things, delivery and fleet coordination, mileage and cost allocation, service verification, fault and incident analysis, battery and charging planning, operational optimisation, analytics and service-performance reporting, and the calculation or administration of compensation, credits or benefits for a rider or driver.

Data received from partners may also be used, combined with other permitted GoCimo data and transformed into derived information for the purposes described in this Policy, including service provision, fraud and security controls, fleet and delivery coordination, maintenance and engineering, business intelligence, product and service development, pricing and capacity planning, analytics, profiling, advertising measurement and reporting, Partner Benefits, commercial data products and sharing with customers, partners or other recipients. Such further use is carried out only where GoCimo has an applicable lawful basis, any required ePrivacy or other consent has been obtained, and the use is compatible with the circumstances in which the data were obtained or is otherwise permitted by applicable law.

Depending on the relevant arrangement and processing activity, the partner and GoCimo may act as independent controllers, joint controllers or, where one party processes personal data solely on behalf of the other and under its instructions, as controller and processor.

3.4 Advertising analytics and inferred information

Campaign and advertisement identifiers, the vehicle carrying an advertisement, display or installation periods, areas and times of circulation, parked display periods, distance and potential exposure; campaign responses, referral or QR interactions, purchases attributed to campaigns and consent records; customer segments, interests, usage patterns and driving or maintenance risk indicators derived from the data described above. Advertising estimates may combine vehicle data with lawfully obtained traffic counts, geographic information and aggregate audience statistics.

An estimate that an advertisement had an opportunity to be seen is not proof that a particular person saw it. Advertising measurement does not include recording or identifying passers-by through cameras, facial recognition, Wi-Fi or Bluetooth scanning. Any such new technology requires a separate assessment and appropriate notices before use.

3.5 Device communications and incident information

When the Customer uses GoCimo's App, website or other digital Services, we may process IP address, device and advertising identifiers where lawfully available, operating system, browser, app version, authentication events, app interactions, cookies, SDK events, technical and security logs, and mobile-device location where enabled or otherwise lawfully available.

We may process communications with Customer Support, including emails, chats, messages, support tickets, feedback, surveys, photographs and other information provided in connection with a support request. Telephone and other voice communications with GoCimo may be recorded after the Customer has been appropriately informed. Basis: documented legitimate interests in providing and improving support, documenting customer instructions and service events, quality assurance, complaint and dispute handling, fraud and security controls, and training or evaluating GoCimo's own support systems, where those interests are necessary and proportionate. Consent or another applicable basis is used where required by applicable law for the particular recording or use.

GoCimo uses artificial-intelligence and other automated tools as part of its Customer Support and service operations. These systems may process Customer communications, call recordings, transcripts, Account and booking information, Vehicle and service information, incident information and other information relevant to the Customer's interaction with GoCimo.

AI and automated tools may be used to transcribe and summarise communications, classify and route support cases, retrieve and identify relevant information, assist Customer Support personnel, generate or suggest responses, analyse service quality, identify recurring issues, detect suspected fraud, misuse or safety concerns, support incident handling, and improve Customer Support and GoCimo's Services.

GoCimo may also use Customer communications, support interactions, call recordings, transcripts, feedback, case outcomes and related service data to train, fine-tune, configure, test, evaluate and improve AI systems and automated tools used by GoCimo. This may include improving how such systems understand Customer requests, classify cases, retrieve information, generate responses, identify operational issues, detect fraud or safety concerns and support GoCimo personnel. Basis: documented legitimate interests in improving Customer Support, service quality, operational efficiency, fraud and safety detection, and GoCimo's own support and service systems, subject to necessity, proportionality and a balancing assessment. Consent is used where required for a particular source of data or processing activity. AI-training, testing and evaluation data are retained only for the defined development and validation cycle and are then deleted, de-linked or irreversibly anonymised unless a longer period is specifically justified and documented.

Where reasonably possible and appropriate for the relevant purpose, data used for AI training, testing or improvement may be minimised, pseudonymised, de-identified or otherwise reduced before use.

AI systems and Customer Support platforms may be provided or hosted by contracted service providers acting on GoCimo's behalf and under GoCimo's instructions. Such service providers are not authorised to use GoCimo Customer data, communications, call recordings, transcripts or other personal data to train, develop or improve their own general-purpose AI models or AI services for their own purposes or for the benefit of other customers, unless GoCimo expressly determines otherwise and any additional requirements under applicable data-protection law have first been satisfied.

Unless otherwise expressly stated in this Policy, GoCimo does not rely solely on automated processing to make decisions that produce legal effects concerning the Customer or similarly significantly affect the Customer.

We may also process damage reports, insurance records, witness information, fines, parking charges, tolls and information relating to suspected misuse, fraud, safety incidents, accidents or claims.

Location data generated by a Vehicle, Battery, IoT device or other GoCimo equipment is collected independently of the Customer's mobile-device location settings or permissions.

Except for biometric data used for identity verification as described in Section 3.1 where applicable, we do not intentionally collect or infer special-category personal data, such as information revealing health, religion, political opinions, trade-union membership or sexual orientation, as part of the ordinary provision of the Services or for advertising or commercial data sharing.

Biometric data are used only for the limited identity-verification purpose described in Section 3.1. GoCimo does not use biometric data for advertising, commercial data products, behavioural profiling or unrelated identification purposes. We do not intentionally process criminal-conviction or offence data except where such processing becomes necessary and is permitted or required under applicable law.

3.6 Vehicle, Battery and IoT Data

Vehicles, Batteries, swap stations and other connected GoCimo equipment use embedded IoT devices, GPS, telematics, connectivity, security, diagnostic systems and other sensors to automatically collect and transmit Vehicle, Battery, location, usage, operational and technical data described in this Policy.

Such data are generated and transmitted independently of the Customer's phone or other personal device and may be collected continuously or at particular events, including during use, parking, charging, Battery swapping, locking or unlocking, maintenance, diagnostics and other interactions with the Vehicle, Battery or GoCimo equipment.

Where a Vehicle, Battery, swap station or other connected equipment is associated with an Account, booking, rental or identifiable user, data generated by that equipment may be linked to the relevant Customer or user.

Vehicle GPS and other onboard tracking or telematics systems operate independently of the Customer's mobile-device location settings or permissions.

3.7 Camera images and recordings

Where camera surveillance is operated, we may process live images and recorded video of individuals and vehicles at battery-swapping stations, vehicle collection and return points and their necessary access areas. Records may include appearance, actions, vehicle registration numbers, visible vehicle or battery identifiers, timestamps and camera location. Relevant footage may be linked to transaction or access records to investigate a specific incident or dispute. The locations, operating times, retention and other site-specific details are provided in the notice for the monitored location.

Unless specifically stated in the notice for a monitored location, the camera surveillance described here does not use audio recording, facial recognition or other biometric identification. Any introduction of such functions is subject to a separate legal assessment and the additional information and safeguards required by applicable law before activation.

4 Sources of Personal Data

We obtain information from you; authorised account holders, employers, fleet operators and delivery platforms; our vehicles, batteries, stations, apps and websites; manufacturers and telematics providers; identity-verification providers, including Sumsub, and payment providers; insurers, workshops, assistance providers, authorities and professional advisers; and lawfully accessed public sources and commercial data providers. Where external datasets are used for matching, enrichment, traffic, mapping or audience measurement, the relevant source category and purpose are described in this Policy or in a specific notice where additional detail is required.

Data combination and derived information. GoCimo may combine information from Accounts, rentals, Vehicles, Batteries, swap stations, Apps, websites, Customer Support, payments, business customers, delivery and logistics platforms, manufacturers, telematics providers, commercial data providers and other permitted sources where this is relevant to a purpose described in this Policy and permitted by law. From such information, GoCimo may create or infer classifications, estimates, predictions, scores, segments, benchmarks, models, trends, statistics, forecasts and other derived insights. Derived information is treated as personal data for as long as it can reasonably be linked to an identified or identifiable person.

Station data come from station controllers, access systems and battery-management systems, including those operated by our service providers. Camera data come from our surveillance systems or, for a specific lawful purpose, from site operators or landlords. Where a site operator controls its own cameras, its camera notice applies to that surveillance; any disclosure to and subsequent use by GoCimo requires its own lawful basis. Where another organisation supplies personal data to GoCimo as an independent controller, its identity is provided where required by applicable law or a specific notice.

When data are obtained indirectly, GoCimo provides the information required by Article 14 GDPR, including the categories and source, within the applicable time limits, unless a lawful exception applies. An employer’s or account holder’s duty to inform drivers does not remove GoCimo’s own transparency obligations.

5 Purposes and Lawful Bases

Contract means Article 6(1)(b) GDPR and applies only where processing is objectively necessary for a contract with the individual or requested pre-contractual steps. A contract with an employer or platform is not automatically a contractual basis for processing its drivers’ data. Legal obligation means Article 6(1)(c). Legitimate interests means Article 6(1)(f), subject to necessity and balancing against individuals’ rights and reasonable expectations. Consent means Article 6(1)(a). Requirements under ePrivacy and national electronic-marketing law apply in addition, as explained below.

Connected-equipment and ePrivacy rule. Where applicable ePrivacy or equivalent national rules require consent for access to or storage of information in a Vehicle, Battery, IoT device, App, website or other connected equipment, GoCimo obtains that consent unless a specific exemption applies, including where access is strictly necessary to provide a service expressly requested by the Customer. A legitimate-interest basis under Article 6(1)(f) GDPR does not replace a separate ePrivacy consent requirement. Further use of data collected or accessed in this way is described in Section 5.7. Where a new purpose is not compatible with the original collection or another legal requirement applies, GoCimo establishes the required additional basis or consent before that processing.

5.1 Accounts rentals payments and customer service

We process identity, contact, account, eligibility, transaction and necessary vehicle-use data to verify drivers, manage accounts and agreements, provide vehicle and battery access, calculate charges, process payments and provide support. Basis: contract for individual customers; legitimate interests in administering business relationships for business contacts and authorised drivers who are not parties to the contract. Statutory records and reporting use legal obligation. Payment authorisation and eligibility verification are not treated as credit scoring unless a separate credit-check service is introduced and specifically disclosed.

5.2 Vehicle location protection and fleet operation

We use current position, vehicle status and necessary journey data to locate, allocate, dispatch, collect and recover Vehicles; confirm handover and return; operate permitted areas; detect unauthorised movement; identify maintenance and repair needs and arrange related servicing, transport and assistance; protect Vehicles and Batteries; and manage fleet availability. Basis: contract to the extent necessary for an individual’s requested service, and otherwise documented legitimate interests in effective fleet operation, asset protection, safety and prevention of loss. Section 6 governs frequency, access and continuous tracking.

5.3 Maintenance repairs warranties and asset management

We analyse telemetry, battery condition, station condition, vehicle condition, usage, diagnostic and repair data to forecast failures; optimise servicing, spare-parts inventory, workshop staffing and repair scheduling; identify recurring faults; manage warranty and supplier claims, recalls and component replacement; assess battery life, safe reuse, recycling and vehicle residual value; and reduce energy, downtime and repair costs. We may provide manufacturers, repairers and warranty providers with relevant technical records and sell anonymised reliability and component-performance analyses. We may also create, license and sell anonymised or aggregated component-wear, sensor, diagnostic and operational-stress datasets and reports to vehicle manufacturers, component suppliers, including tyre, brake, battery and other hardware suppliers, and engineering partners for product-quality improvement, reliability analysis, warranty analysis and claims, component development, testing and hardware-design optimisation. Basis for necessary personal-data processing: legitimate interests in safety, reliable equipment, efficient asset management, product and component improvement, engineering analysis and substantiating claims. Personal identification and exact routes are excluded where technical data suffice.

5.4 Driving analysis safety and accident prevention

We may analyse acceleration, braking, speed variation, cornering, journey conditions, Vehicle condition and incident history to identify potentially unsafe driving, mechanical risk, unusual wear or possible collisions; provide warnings and coaching; investigate incidents; support maintenance, engineering and product-quality analysis; and assess preventative actions. Indicators are estimates, not proof that a driver will cause an accident or has committed an offence. We consider data quality, Vehicle type, road and traffic conditions, weather and sensor limitations where relevant. Basis: documented legitimate interests in protecting drivers, the public and assets, improving safety, maintenance and equipment reliability, and preventing loss, where necessary and proportionate. Separately requested optional coaching, insurance, behavioural profiling or other uses that require consent under GDPR, ePrivacy or applicable national law are activated only after the required consent or another specifically established lawful basis is in place.

Identifiable scores are disclosed to employers, platforms or insurers only for an identified lawful purpose with suitable safeguards, not automatically because they are commercial partners. Decisions affecting access, charges, insurance or work opportunities are subject to Section 12. Where a driver-linked safety score, coaching function or similar model is activated, GoCimo provides additional information where the model, its inputs or its consequences materially affect the individual.

5.5 Delivery and logistics services

We may supply fleet and delivery dashboards, APIs and reports to organisations using GoCimo vehicles to transport food or goods, including couriers, merchants, delivery platforms and logistics operators. Functions may include vehicle availability, dispatch, journey progress, estimated arrival, charging or swapping needs, distance allocation, utilisation, service completion and operating-cost or emissions reporting. A delivery customer may receive limited journey progress where required for a requested delivery. Access is limited to the relevant vehicles, assignments and authorised periods; unrelated customers’ data and off-duty movements are excluded.

Basis: contract where the driver or other individual requests or uses the relevant service or functionality; otherwise documented legitimate interests in coordinating, verifying, administering and improving contracted delivery, fleet and partner services, subject to applicable workforce and data-protection safeguards. Where GoCimo acts only as processor, the business customer must establish its own lawful basis. Consent is used only where required by applicable law or where GoCimo chooses to rely on consent for a specific optional function. Workforce consent is not assumed to be freely given. The data shared and the controller or processor roles depend on the relevant integration and are limited to what is reasonably necessary for the disclosed service, benefit, programme or other stated purpose.

Partner Benefits and Top-Ups. As part of the Services and, where applicable, the Wallet functionality described in the Terms and Conditions, GoCimo may verify whether Customers are eligible for benefits, discounts, credits, Top-Ups or other advantages offered in cooperation with participating food-delivery, logistics and other business partners. For this purpose, GoCimo may exchange and match the limited Account, identity, platform, eligibility, activity and transaction information reasonably necessary to determine, verify and administer the relevant benefit, including information about current or previous activity with the relevant platform where this forms part of the applicable eligibility criteria. Where the Customer requests, activates or uses the relevant Partner Benefit or Wallet functionality, processing that is objectively necessary to provide that functionality is based on Article 6(1)(b) GDPR. Related processing for fraud prevention, reconciliation, accounting, programme administration, reporting and improvement may rely on another applicable lawful basis, including legitimate interests where the relevant requirements are met. No separate consent is required solely because such a Partner Benefit, discount, credit or Top-Up is determined or credited, unless a specific programme includes additional optional processing for which consent is required by applicable law.

5.6 Advertising on vehicles and exposure reporting

We may use campaign, vehicle, location, timing, distance and parked-display information to verify that vehicle advertising was displayed; calculate geographic coverage, display duration and opportunities to see; estimate audience reach and frequency; detect invalid campaign activity; support advertiser invoicing; optimise campaigns; and sell measurement and verification reports. Advertisers, agencies and measurement providers normally receive anonymous reports aggregated across suitable areas, time periods and vehicle groups. A single vehicle’s detailed route or a small group is not treated as anonymous merely because driver names are omitted.

Basis for proportionate advertising measurement, verification, optimisation, reporting and anonymisation: documented legitimate interests in delivering, verifying, improving and commercialising advertising services, following an assessment of necessity, compatibility with the original collection purpose and less intrusive alternatives. GoCimo may use Vehicle, location, timing, distance, display and other operational data that have been lawfully collected or accessed for these purposes where the resulting impact on individuals is limited and proportionate. Where a particular collection, access or measurement flow requires consent under GDPR, ePrivacy or applicable national law, including certain driver-linked, device-tracking or behavioural advertising uses, that consent is obtained before the consent-dependent collection, access or use. A legitimate-interest assessment does not override such a consent requirement. Commercial value alone does not create a lawful basis, but it may form part of a legitimate commercial interest where the remaining legal conditions are met. Measurement methods, aggregation thresholds and service providers may vary by campaign.

5.7 Commercial data products licensing and resale

GoCimo may create, sell, license, exchange or otherwise provide data products, reports, dashboards, API access, forecasts and benchmarking services, including through data brokers, marketplaces, aggregators and resellers. Products may concern mobility flows, delivery demand, traffic and road conditions, area footfall estimates, station and site planning, advertising exposure, energy demand, battery health, component wear, sensor and diagnostic performance, operational stress, repair demand, fleet economics, reliability and environmental performance. Customers may include advertisers, logistics businesses, vehicle manufacturers, component and hardware suppliers, engineering partners, insurers, researchers, property and infrastructure operators and public bodies. The data behind these products is handled at three levels, described below. Level 1 covers pseudonymised or identifiable data linked to a Customer or Authorised Driver, which is disclosed only with consent. Level 2 covers Vehicle, Battery and infrastructure data that have been separated from individuals. Level 3 covers anonymous and aggregated data. A product is classified by the most identifiable data it contains.

Level 1 – Pseudonymised or identifiable data linked to Customers or Authorised Drivers. GoCimo may sell or license identifiable or pseudonymised data, including permitted contact, usage, profile or location data, to independent commercial data partners only where the individual has given the data-sharing consent described in Section 11, which is separate from the marketing and personalisation consent and is supported by this Policy and any accompanying notice describing the data, the purposes, the recipients or categories of recipients and the permitted onward disclosures. Before consent is given, the consent flow or accompanying notice identifies the relevant independent controllers, the data and purposes covered, permitted onward sharing and any material international-transfer information. Payment or other commercial consideration may be received. Pseudonymised data remain personal data and are subject to the safeguards applicable to personal data. A broker may not freely resell such data to unspecified parties or for unrelated purposes. New recipients or materially new purposes require an updated valid basis and, where the existing consent does not cover them, new consent. Refusing or withdrawing that consent does not affect use of the core Services or the marketing and personalisation consent.

Level 2 – Vehicle, Battery and infrastructure data separated from individuals. GoCimo may commercialise diagnostic, battery-health, component-wear, sensor, operational-stress, energy-demand, station and similar technical data, and insights derived from them, where the data have been separated from Customers and Authorised Drivers before they leave GoCimo's control and cannot reasonably be linked back to an individual, taking into account booking, vehicle-identifier, location and other data that GoCimo or the recipient could reasonably combine with them. Data that remain linkable to an individual by such means are treated as Level 1. Recipients must not attempt re-identification and must comply with the restrictions imposed by GoCimo, but that contractual restriction alone does not establish that data are not personal data. Data Act, fleet-customer and other contractual rights and restrictions continue to apply.

Level 3 – Anonymous and non-personal outputs. To the extent information has been irreversibly anonymised or otherwise no longer constitutes personal data, GoCimo may retain, combine, analyse, use, disclose, license, sell and otherwise commercialise that information for any lawful business purpose, including product and service development, benchmarking, engineering, mobility and infrastructure analysis, fleet optimisation, advertising and measurement, sustainability and ESG services, forecasting, research, licensing of datasets, reports, models and analytical services, and the development of new commercial offerings. GoCimo may also retain and commercialise anonymous statistics, algorithms, model parameters, benchmarks, forecasts and insights derived from lawfully processed data, provided that they do not permit the relevant individual to be reasonably re-identified. Contractual, confidentiality, intellectual-property, Data Act and other applicable restrictions continue to apply. Whether information is anonymous is assessed against the means reasonably likely to be used to identify a person, including when combined with other reasonably available data, and is reviewed periodically. Recipients must not attempt re-identification, but that contractual restriction alone does not establish anonymity.

Sustainability and ESG products (Levels 2 and 3). GoCimo may aggregate, analyse, report, license and commercialise anonymised or fleet-level distance, energy-use, vehicle-utilisation and emissions-avoidance data to calculate and substantiate sustainability and emissions metrics; prepare ESG, sustainability and environmental-performance reports for B2B fleet customers, public authorities, certification bodies and other relevant organisations; and, where permitted by applicable law and the relevant methodology or certification scheme, support the creation, verification, certification, aggregation, transfer or commercialisation of carbon offsets, carbon credits, environmental certificates or similar climate-related instruments. Such activities may include comparing electric-vehicle operation with appropriate reference or baseline scenarios and using distance, energy-consumption, charging, battery and operational data to quantify avoided emissions. Personal identifiers and individual journey details are excluded where anonymised, aggregated or fleet-level data are sufficient.

Creating Level 2 and Level 3 products. Personal data may be analysed, combined, transformed, separated from individuals and anonymised to create such outputs where the underlying data were lawfully collected or accessed and the further processing has an applicable lawful basis. Documented legitimate interests may support necessary and proportionate analysis, product development, benchmarking, commercial reporting, separation from individuals and anonymisation where compatible with the original collection and individuals' reasonable expectations; consent is used where required by GDPR, ePrivacy or applicable national law. Consent to a particular collection or device access does not extend to other purposes. Identifiable or pseudonymised location and driver-linked data collected or accessed for operating the Services are used by GoCimo for advertising, audience services, sale or licensing to third parties, or driver-linked profiling only where those purposes are covered by the Customer's valid consent. Other further uses, such as maintenance, safety, billing, fraud prevention and service improvement, rely on the bases in Section 5 and only where the use is compatible with the original purpose. This does not restrict GoCimo's use of data that have been irreversibly anonymised (Level 3).

5.8 Marketing partner offers and audience services

We may promote GoCimo and partner products, sell sponsored placement in our apps and communications, make contextual or personalised recommendations, operate referral and loyalty programmes, and measure campaign response. We may create audience segments from permitted account, booking, engagement and preference information; match permitted identifiers to advertising platforms; and measure conversions. A hashed email or device identifier is not treated as anonymous merely because its original form is concealed.

Basis: consent for partner electronic marketing, advertising tracking, platform audience matching and other processing where required. Where applicable national rules permit marketing our own similar services to existing customers, we may rely on legitimate interests and provide an opt-out when details are collected and in every message. Limited first-party personalisation may use legitimate interests after assessment; precise journey-based or real-time location-based advertising is used only with the marketing and personalisation consent described in Section 11, which covers location and journey data. We do not use sensitive inferences for advertising. Channels, platforms and partner categories may change over time, and consent-dependent processing is activated only through the relevant consent or preference controls.

5.9 Insurance fraud claims and cost recovery

We may use relevant account, payment, telemetry, incident and journey records to investigate theft, fraud, damage, contractual misuse and insurance claims; allocate substantiated costs; collect debts; and establish, exercise or defend legal claims. Necessary records may be provided to insurers, claims handlers, lawyers, recovery providers or competent authorities. Basis: documented legitimate interests in protecting assets and rights, or an applicable legal obligation. Article 9 or 10 conditions must additionally be met where relevant.

Optional usage-based insurance, driver rewards or risk-pricing services may be offered with a specific notice identifying the insurer or other responsible party, the relevant data, material effects and lawful bases. Driver-linked insurance scoring or disclosure for an optional programme requires the applicable consent or other specifically established basis; this Policy alone does not activate such a programme.

5.10 Planning pricing development and analytical models

We may analyse permitted usage, telemetry, transaction, support, partner and service data to forecast demand; select and evaluate station and operating sites; optimise fleet size, Vehicle allocation, routes, charging and energy procurement; assess profitability and unit economics; plan staffing and capacity; improve support, operations, products and pricing; develop service packages, partner programmes, commercial reports and analytical products; and train, test and validate models for the maintenance, safety, demand, customer-support, advertising-measurement and other compatible purposes described in this Policy. Basis: legitimate interests in efficient operations, business intelligence, service and product development, safety, cost reduction and commercialisation, where necessary, proportionate and compatible with collection. This basis applies to further analysis of data that have been lawfully collected or accessed; it does not replace any consent separately required for the original collection of or access to connected-device, telemetry, location, cookie or similar data. Consent is used where required for a particular collection, access or optional processing activity.

We favour anonymous or aggregated inputs and limit driver-linked training data to justified tasks. Customer Support AI and the use of Customer Support data to train, fine-tune, test and improve AI systems used by GoCimo are described in Section 3.5. Model development does not create a general right to train unrelated models on customers’ identifiable journeys. Disclosure to a supplier for its own model development requires a separately established basis and notice. Anonymous benchmarks, models and analytical services may be licensed commercially. Individually personalised prices or decisions with significant effects require the information and safeguards in Section 12.

Cross-service improvement and new uses. GoCimo may use and combine data lawfully available across its Services to improve existing functions and to research, test, develop and launch new Vehicles, Battery and swapping services, fleet and logistics functions, safety and maintenance tools, pricing and subscription products, partner programmes, customer-support tools, advertising and measurement services, engineering and sustainability products, and other related mobility or data-driven services. Where an intended new use is compatible with the original purposes and another applicable lawful basis supports it, GoCimo may use existing data without obtaining a new consent solely because the product, model or commercial format is new. Where compatibility cannot be established, or GDPR, ePrivacy or other applicable law requires consent or additional information, GoCimo provides that information and obtains the required consent or establishes another lawful basis before the new processing begins.

5.11 Authorities research and public infrastructure

We may provide necessary information to police, courts, tax, transport, municipal and other competent authorities in response to applicable legal duties or valid orders. We assess the scope and authority of each request. Voluntary disclosures require a separate lawful basis, such as a proportionate legitimate interest in reporting a specific incident; urgent protection of life may exceptionally rely on vital interests under Article 6(1)(d). A public authority’s own powers do not automatically authorise every disclosure by GoCimo.

We may provide or sell anonymous statistics for urban planning, road safety, transport research, infrastructure, emissions and policy evaluation. Identifiable research or municipal reporting requires a defined basis, appropriate safeguards and any additional information required for that programme; it is not covered by a general public-interest label. Recurring mandatory disclosures are made only where an applicable legal obligation actually requires them.

5.12 Business administration and transactions

We process necessary business-contact and financial records for procurement, accounting, audits, legal compliance, group administration, financing, asset sales and corporate transactions. Basis: applicable legal obligations or legitimate interests in administering and financing our business. Potential buyers, investors, financiers and advisers receive limited data with confidentiality and access safeguards; anonymous financial and operational information is used where sufficient. A corporate transaction does not authorise unrelated use of driver data.

5.13 Station operation and battery transaction analysis

We use station and swap records to authenticate access, deliver and verify battery swaps, allocate charges and resolve transaction disputes; manage inventory and availability; detect faults, overheating, tampering and unauthorised access; plan charging, energy purchases, station capacity and maintenance; and analyse demand and battery performance. Basis: contract for necessary service delivery to the individual; otherwise documented legitimate interests in safe, secure and efficient station operation and cost allocation. Anonymous station-use, energy and demand analyses may form part of the commercial products in Section 5.7. Identifiable partner reporting, advertising and resale remain subject to their separate conditions. Precise station visits can reveal a person’s movements and are not treated as anonymous merely because they come from a fixed station.

5.14 Camera surveillance at stations and vehicle handover locations

GoCimo may operate cameras at the locations described in Section 3.7 to prevent and investigate theft, vandalism and unauthorised use; protect people, vehicles, batteries and station equipment; investigate accidents, damage and safety incidents; and verify collection, return or swapping events when a concrete dispute arises. The purposes used at each location are stated in its camera notice. Basis: documented legitimate interests in those specific safety, asset-protection and claims purposes, only where the site-specific need outweighs the impact on individuals. A legal obligation is relied on only where an identified law actually requires the processing.

Before activation, we assess necessity, less intrusive alternatives, camera coverage, operating times, access and retention for each location, and complete an impact assessment where required. We limit capture of surrounding public space and neighbouring premises and use masking where appropriate. Cameras are not used for routine assessment of employees’ productivity. Applicable national camera and employment rules must also be met. Entering a signed area or accepting rental terms is not treated as consent to surveillance.

Visible signs inform people before they enter a monitored area and direct them to a fuller site-specific camera notice identifying the controller, contact route, purposes and legal basis, retention or retention criteria, recipients and rights. The notice may be provided by QR code, web page or another readily accessible method and may differ by location.

Security footage is not included in advertising or personal-data resale programmes described elsewhere in this Policy. Any camera-based visitor counting, commercial analytics or advertising measurement requires a separately defined and notified purpose, lawful basis and appropriate safeguards before use; later anonymisation does not by itself make the original collection lawful. Retention and incident preservation are described in Section 9.

6 Vehicle Location and Access Controls

Vehicles transmit location in real time or at frequent intervals throughout the period in which they are assigned to a Customer, including while moving, parked or not actively being driven, and may also transmit location between bookings, during servicing or transport and when unauthorised movement, loss or another incident is suspected. Tracking frequency and precision vary by equipment, connectivity and operational state. Constant availability of a current asset position does not mean unlimited retention of every driver’s historical route; retention is governed by Section 9.

Where access to or storage of information on a Vehicle, Battery, IoT device or other connected equipment is subject to ePrivacy or equivalent national rules, GoCimo does not rely on legitimate interests to override a consent requirement. Any required consent is obtained before the consent-dependent access or storage takes place. Where the legal conditions for an exemption apply, including access that is strictly necessary to provide a service expressly requested by the Customer, GoCimo may operate the relevant function without separate ePrivacy consent. Further use of data collected or accessed in this way is described in Section 5.7.

A customer cannot normally disable a tracking function that has been lawfully established as necessary to provide or secure the contracted vehicle service. Optional advertising or analytics tracking remains subject to the relevant choices. Disabling required equipment may breach the service agreement, but does not remove rights to object, withdraw optional consent or challenge unnecessary processing. Any essential-service consequences are explained before contracting.

Identifiable operational location is accessible only to authorised personnel and providers who need it for their role. Business partners receive the limited access described in Section 7. Consent-based commercial access is separately controlled. We do not use the vehicle’s current position to follow a former renter after their booking ends. Historical records remain subject to Section 9. Phone-location permissions can be changed in device settings without automatically disabling the vehicle’s separate telematics.

7 Sharing Personal Data and Commercial Access

Subject to the purposes, bases and limits above, recipients may include GoCimo companies; cloud, hosting, security, telematics, app, analytics and communications providers; vehicle and battery manufacturers; workshops, logistics and assistance providers; identity-verification providers, including Sumsub, and payment providers; banks, accountants, auditors, debt collectors and advisers; insurers; business customers, delivery platforms, merchants and fleet managers; advertisers, agencies, measurement companies, commercial data partners and resellers (which receive identifiable or pseudonymised data only with consent as described in Sections 5.7 and 11 and otherwise only Level 2 or Level 3 data); research, infrastructure and public-sector recipients; and parties to lawful corporate transactions.

We distinguish processors acting only on our documented instructions from independent or joint controllers using data for their own defined purposes. Processor agreements restrict processing and subcontracting. Controller-to-controller arrangements specify purposes, data, security, retention, rights handling and permitted onward sharing; a contract does not itself supply a GDPR lawful basis. Where we jointly determine processing, we provide the essence of the joint-controller arrangement.

Employers, fleet customers, delivery platforms and other business partners may receive data for the disclosed fleet, delivery, partner-benefit, reconciliation, reporting or other stated purpose, but not unrestricted access to a driver's private movements. GoCimo assesses its own disclosure and access settings; the recipient must independently comply with applicable employment, platform-work and data-protection requirements. End-customer tracking links and similar temporary access are limited to the relevant delivery, Vehicle, assignment, benefit or authorised period and expire when no longer needed.

For commercial personal-data sharing (Level 1 in Section 5.7), GoCimo uses the lawful basis applicable to the particular purpose and relationship. Where consent is required or relied upon, the applicable consent flow or specific notice identifies the independent controllers relying on that consent and the agreed downstream uses. Where sharing is based on contract, legitimate interests, legal obligation or another lawful basis, the relevant categories of recipients, purposes and safeguards are described in this Policy or the applicable service information. We require recipients to respect applicable purpose, security, retention and onward-sharing restrictions and to support data-subject rights where required. No indefinite or unrestricted personal-data resale right is granted.

GoCimo may structure integrations so that a partner processes data as GoCimo's processor, as an independent controller, or jointly with GoCimo, depending on who determines the purposes and essential means of processing. Where a partner collects information directly from a Customer through an integrated or partner-operated feature, the partner may process that information under its own privacy information and lawful basis. GoCimo may receive permitted results, status information, identifiers, measurements or other outputs from that partner and use them for the purposes described in this Policy, subject to the applicable controller roles and legal requirements.

Camera footage is accessible only to authorised staff and contracted security or technical providers who need it for the stated purposes. Relevant extracts may be disclosed to insurers, legal advisers, police, courts or a site operator only where necessary and supported by an applicable lawful basis and any national confidentiality rules. General site access or commercial partnership does not confer unrestricted footage access. Separate site controllers and any joint-control arrangement are identified in the camera notice.

8 International Transfers

Sharing between EEA countries remains subject to GDPR but is not a third-country transfer. Where data are accessible from or transferred to a country outside the EEA, including through support access or subprocessors, we use an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. We assess transfers and apply supplementary measures where required. Derogations are used only where their specific conditions are met, not as a routine substitute for safeguards. Information and a copy of relevant safeguards may be requested using Section 17, subject to necessary redactions.

Current material non-EEA transfer destinations include the United States, and Taiwan. The same safeguards apply where Sumsub, as identity-verification provider, or its subprocessors process or access data outside the EEA. Transfers to countries or organisations covered by an applicable European Commission adequacy decision rely on that decision. Where no adequacy decision applies, GoCimo uses appropriate safeguards, primarily the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

9 Retention Anonymisation and Deletion

We retain identifiable data for no longer than needed for the particular purpose, applying the periods or criteria below. Different copies and derived profiles may have different justified retention periods. A live account, a potential future commercial opportunity or a long accounting retention period does not by itself justify keeping detailed journey histories. Where a dispute or incident requires longer retention, we preserve the relevant records with restricted access rather than the entire unrelated dataset.

Anonymisation may use removal of identifiers, geographic and time generalisation, aggregation, suppression of small groups and additional controls appropriate to re-identification risk. The method and threshold depend on the dataset and intended use and are reviewed against reasonably available means of re-identification. Detailed routes, persistent vehicle codes and rare patterns are not assumed anonymous. Anonymous information cannot normally be linked back to a person to fulfil a later access or deletion request. Pseudonymised data remain personal data and subject to rights and retention limits.

10 Security

We implement technical and organisational measures appropriate to the risks. Depending on the system and data, these measures may include role-based access, authentication, encryption, logging, separation of operational and optional commercial datasets, supplier controls, confidentiality, backup and recovery, incident handling and periodic review. Commercial APIs and exports are restricted to approved fields, purposes and users. The measures are reviewed and adjusted as systems, risks and legal requirements change.

Before introducing or materially changing processing that is likely to result in a high risk to individuals, GoCimo carries out a data protection impact assessment where required by Article 35 GDPR. This assessment may cover, as applicable, systematic or large-scale location and telematics monitoring, driving-behaviour profiling, biometric identity verification, AI and automated analysis, matching of datasets, camera surveillance and other connected-vehicle or connected-station processing. Mitigating measures are documented and reviewed, and the competent supervisory authority is consulted where required before high-risk processing begins.

11 Marketing Choices Cookies and Consent

Consent is requested through clear, affirmative choices that are not pre-selected and are presented separately from accepting rental terms. GoCimo asks for two optional consents, and each can be given or refused on its own. (1) Marketing and personalisation consent: “I consent to GoCimo using my personal data, including location, journey, vehicle-use, driving, account and interaction data, to personalise advertising, offers and discounts; to create audience segments and analytics and to profile my interests and use of GoCimo for these purposes; to share identifiers and campaign data with advertising and measurement platforms so that they can show and measure GoCimo’s campaigns; and to send me marketing communications from GoCimo and its partners.” (2) Data-sharing consent: “I consent to GoCimo sharing, licensing or selling my contact, account, usage, journey and location data, in identifiable or pseudonymised form, to independent commercial data partners listed or categorised in the Privacy Policy, for their own purposes as described there. GoCimo may receive payment for this.” Each consent text links to this Policy, which describes the purposes, the data categories (Sections 3, 5.7 and 5.8) and the categories of recipients and independent controllers (Sections 5.7 and 7). New recipients or materially new purposes require an updated notice and, where the existing consent does not cover them, new consent.

Separate consent is requested where GDPR, ePrivacy or applicable national law requires a distinct consent, including explicit consent for biometric identity verification and any device-access or cookie/SDK consent that cannot lawfully be covered by the same choice. Giving or refusing either consent does not affect processing that is necessary to provide the core Services or that has another valid lawful basis, and refusing one consent does not affect the other. Consent-dependent processing is activated only for the purposes covered by the consent actually given. Each consent can be withdrawn separately and as easily as it was given, and withdrawal stops all processing that relies on it. Preferences can be managed through the controls made available in the relevant App, website or service, or by contacting GoCimo under Section 17.

Refusing or withdrawing optional consent does not prevent use of the core rental and battery-swapping service. A specific optional feature may cease if its required consent is withdrawn. Partner Benefits, discounts, credits, Top-Ups and similar programmes that form part of the Services or Wallet functionality and are requested, activated or used by the Customer do not require consent merely because they involve personal-data processing. Processing objectively necessary to determine and administer the relevant benefit may rely on Article 6(1)(b) GDPR, while related fraud prevention, reconciliation, accounting, programme administration, reporting and improvement may rely on another applicable lawful basis, including legitimate interests where appropriate. Consent is used only where a particular Partner Benefit programme includes additional optional processing for which applicable law requires consent. A business customer cannot provide blanket consent on behalf of its drivers.

We use non-essential cookies, advertising SDKs, pixels and similar device-access technologies only after obtaining consent where required. Strictly necessary technologies are limited to their permitted functions. Further information about providers, purposes, duration and controls is made available through GoCimo’s cookie and SDK notice or the relevant website or App cookie settings. Mobile operating-system permission alone does not constitute consent to every subsequent use or disclosure.

You can object to direct marketing and associated profiling at any time, and we will stop that processing. Optional marketing preferences are separate from necessary service, billing and safety communications. Withdrawal stops future consent-based processing without invalidating earlier lawful processing. We communicate withdrawals and other rights requests to recipients where required and operate agreed downstream mechanisms; recipients may retain only information for which they have a separate lawful obligation or other valid basis that actually applies. We do not automatically switch to legitimate interests merely to continue the same processing after withdrawal.

12 Profiling and Automated Decisions

The profiling described in Section 5 may produce customer segments, predicted demand, maintenance indicators or driving-risk scores. Driving models may compare event frequency and severity relative to use and context; advertising models may group permitted interests or activity; maintenance models may predict failure from telemetry and repair history. Model outputs can be incomplete or inaccurate and do not establish fault or future behaviour.

Our operating rule is that decisions with legal or similarly significant effects, such as refusing vehicle access, materially changing individual charges, adverse insurance decisions or decisions affecting work, are not made solely by an automated score unless a specific Article 22 exception and required safeguards have been established. Human review must be meaningful and performed by a person with authority to change the result. Individuals may explain circumstances and challenge inaccurate data or outcomes.

GoCimo may use automated checks to verify objective service requirements such as identity verification, including selfie-to-document facial comparison where enabled, required driving-licence validity or category, payment authorisation, account or security status and other eligibility conditions. A failed check may prevent or pause registration, payment, booking or Vehicle access. These checks compare available information with the applicable service requirements and are not used to infer unrelated sensitive characteristics. Biometric identity verification is subject to the conditions described in Section 3.1. Where a decision is made solely by automated processing and falls within Article 22 GDPR, GoCimo relies on an applicable Article 22 exception and provides the required safeguards, including the ability to obtain human intervention, express a view and contest the decision. GoCimo does not use automated driving-risk or advertising scores alone to refuse Vehicle access or materially change individual charges unless separately disclosed with the safeguards required by law.

No general permission for automated adverse decisions is obtained by accepting this Policy. Any regulated AI or employment-related use requires its own applicable safeguards. The relevant service notice identifies any independent insurer, employer or platform responsible for its own decisions.

13 Your Rights

Subject to applicable conditions, you may request access and a copy, correction, erasure, restriction, data portability and information about international-transfer safeguards; withdraw consent; object to processing based on legitimate interests; and challenge significant automated decisions. You have an unconditional right to object to direct marketing and related profiling. For other legitimate-interest objections, we assess your circumstances and stop processing unless we demonstrate compelling overriding grounds or processing is needed for legal claims.

Requests can be made using the contact details in Section 17 or through any rights-request function made available in the relevant App or website. We normally respond within one month; a lawful extension of up to two further months may apply for complex or numerous requests, with reasons provided within the first month. We may request proportionate identity verification where necessary. Rights are normally free of charge, subject to statutory exceptions.

Where essential account, eligibility, payment or operational vehicle data cannot lawfully be processed, we may be unable to provide the affected service and will explain why. Exercising rights concerning optional advertising or resale does not itself justify refusing the core service. Account closure, optional consent withdrawal and marketing opt-out can be requested separately. We inform relevant recipients of corrections, erasure or restrictions where required by law.

14 Other Drivers and Business Customers

Account holders and business customers must inform authorised drivers about telematics and provide this Policy before vehicle use. GoCimo also provides or makes the Policy accessible at registration, handover, through a link or QR code, or by another appropriate method. Drivers without an individual App account can exercise applicable choices and rights using the contact details in Section 17 or any alternative method stated in the relevant service notice. No person may give consent for another driver’s optional advertising or resale merely because they pay for the Vehicle.

Fleet customers must configure access for legitimate purposes, inform their workers, observe applicable labour and collective-consultation rules, and avoid disproportionate monitoring. GoCimo’s contract with an organisation does not waive drivers’ rights or authorise unrelated workforce scoring.

15 Children and Minimum Age

Vehicle use is limited by the minimum age and licence requirements applicable to the relevant Vehicle and country. GoCimo does not knowingly permit use by a person who does not meet those requirements. Where a minor may lawfully use a Service, we provide age-appropriate information and apply any parental-authorisation requirements that apply. We do not use minors’ data for behavioural advertising or commercial personal-data resale.

16 Changes and New Purposes

We may update this Policy as Services, technology, business models, partners, data sources, analytics and legal requirements change. The current version is made available on GoCimo's website and, where applicable, in the App or relevant service interface. Material changes are communicated before they apply where required. GoCimo may develop new functions, products, analytical methods and commercial services using data already lawfully held where the new processing is compatible with the original purpose and supported by an applicable lawful basis. Before using existing data for a materially new or incompatible purpose, GoCimo assesses compatibility and the lawful basis and provides any additional information required by law. New consent is obtained where required; an updated Policy does not retroactively authorise incompatible use of historic data or extend an existing consent beyond its scope.

17 Contact and Complaints

Privacy contact: privacy@gocimo.com
Postal address: GoCimo Group AB, c/o Mattias Tingvall, Västmannagatan 49, 113 25 Stockholm, Sweden, or the address of the relevant controller listed in Section 2.

Data Protection Officer: GoCimo assesses the requirement to designate a Data Protection Officer under Article 37 GDPR as its processing activities and scale develop. Where a DPO is required or formally designated, the current DPO contact details will be published through GoCimo's website or other appropriate privacy information and notified to the competent supervisory authority as required.

You may complain to the competent supervisory authority, including in the EEA country where you live, work or consider an infringement occurred. Relevant authorities include Integritetsskyddsmyndigheten in Sweden (www.imy.se), Autoriteit Persoonsgegevens in the Netherlands (www.autoriteitpersoonsgegevens.nl), and Datatilsynet in Denmark (www.datatilsynet.dk). Contacting GoCimo first is not a condition for making a complaint.

18 Connected Product Data and Other Rights

Where applicable, the EU Data Act provides additional rights concerning access to and sharing of connected-product and related-service data. This Policy does not limit those rights and is not the contractual agreement required for GoCimo’s use or third-party disclosure of non-personal product data. Where required, the relevant product-data information, permitted commercial uses, user access and sharing arrangements are provided in the applicable service agreement, data terms or a separate Data Act notice before or in connection with the relevant connected-product service.

Commercial use remains subject to applicable confidentiality, trade-secret, intellectual-property, database and contractual obligations. An employer’s, platform’s or customer’s commercial data are not freely available for resale merely because they do not identify an individual.