This Policy is intended to comply with the Data Protection and Privacy Act No. 13 of 2024 of the Republic of Vanuatu (the “Data Protection Act”), which commenced on 2 January 2025.

1. DATA CONTROLLER, SCOPE AND DEFINITIONS

1.1. The data controller for the processing described in this Policy is Hemia Nao Tek Ltd.

1.2. This Policy applies to registration, verification, use of BroCar Driver, Order activity, payments and Personal Account records, ratings, safety and fraud controls, support communications and related driver-facing BroCar functionality in Vanuatu.

1.3. “Driver” or “Partner” means an individual who registers to access Order information and provide transportation, delivery or other services to Clients. Each BroCar Driver account is assigned to one registered user and may be used only by that user.

1.4. BroCar is an information and technology service and is not the Driver’s employer solely because the Driver uses BroCar Driver. The Driver’s contractual status is governed by the License Agreement and any applicable separate arrangement.

1.5. Taxsee (Thailand) Co., Ltd. is a technology provider with authorised technical access to the BroCar platform and database. To the extent it processes Driver personal data on behalf of Hemia Nao Tek Ltd., it acts as a data processor subject to BroCar’s instructions and applicable contractual and legal safeguards.

2. PRINCIPLES AND LAWFUL BASES

2.1. BroCar processes Driver personal data in accordance with sections 4 and 5 of the Data Protection Act: lawfully, fairly and transparently; for specified purposes; using only data reasonably necessary; maintaining reasonable accuracy and security; and retaining identifiable data no longer than necessary.

2.2. Depending on the activity, processing may be based on:

• consent for a specific purpose where required;

• entering into or performing the Driver’s License Agreement or another agreement with BroCar;

• protecting the rights or legitimate interests of the Driver, Client or another natural person, including safety;

• compliance with a legal obligation applicable to BroCar;

• a task carried out in the public interest where applicable; or

• BroCar’s or a third party’s legitimate interests, such as platform security, fraud prevention and service quality, where those interests are not overridden by the Driver’s fundamental rights and freedoms.

2.3. Where consent is used, BroCar will be able to demonstrate the consent and will permit withdrawal as required by section 8 of the Data Protection Act.

3. DRIVER DATA BROCAR MAY PROCESS

3.1. Identity, contact and eligibility data

• full name and date of birth;

• phone number and e-mail address;

• account/login identifiers, authentication data and account settings;

• identity-document details and copies where required for verification;

• driver’s licence details;

• public land transport driver permit and other PLTA-related permit details where required;

• profile/portrait photograph;

• information reasonably necessary to verify that the Driver is legally eligible to provide the selected services.

3.2. Vehicle, permit and insurance data

• vehicle make, model, type and colour;

• vehicle registration plate and registration document;

• public land transport vehicle permit;

• VIN/chassis number where reasonably required for verification;

• insurance information where required by law, the selected service or BroCar verification rules;

• vehicle inspection, roadworthiness or compliance information where required.

3.3. Geolocation and route data

BroCar Driver receives the Driver’s geolocation while BroCar Driver is running/being used and the required device location permission is enabled. Geolocation is used to display relevant Orders, support route and arrival functions, show Order progress to the Client where appropriate, calculate service information, and support safety, fraud prevention and dispute resolution.

BroCar Driver does not collect the Driver’s geolocation when the BroCar Driver application is switched off/terminated. If location access is disabled while the Application is running, Order, navigation and availability functionality may be unavailable or materially limited.

3.4. Order, performance and account data

• Orders offered, viewed, accepted, declined, cancelled and completed;

• pick-up, destination, route, timestamps, status and availability events;

• Partner Fee, Personal Account balance, credits, deductions, payment and settlement records;

• ratings, Client feedback, complaints, safety reports and service-rule violations;

• support cases, appeals, lost-property and dispute records;

• fraud, security and account-integrity indicators.

3.5. Device, network and technical data

• device identifier and operating system;

• Application version and technical logs;

• IP address and network/operator information;

• crash, diagnostic, performance and security information;

• authentication, session and security-event information.

3.6. Communications

BroCar may process support correspondence and, where permitted by law, recordings of calls made to or through BroCar support for quality, training, safety, fraud investigation and dispute resolution.

4. SOURCES OF DRIVER DATA

BroCar may obtain Driver data directly from the Driver; automatically from BroCar Driver and the device while the relevant functionality is being used; from Clients in ratings, complaints or safety reports; from payment, telecommunications or technology providers; from PLTA, police, courts or other competent authorities where lawful; and from other lawful sources necessary for verification, safety, fraud prevention or legal compliance.

5. WHY DRIVER DATA IS USED

• register and authenticate the Driver and maintain the Driver account;

• verify identity, driving eligibility, permits, vehicle information and service eligibility;

• provide access to BroCar Driver and make relevant Orders available;

• enable communication and Order-progress information for Clients and Drivers;

• calculate proposed Order prices, Partner Fees and Personal Account records;

• process or reconcile settlements and non-cash payments where enabled;

• maintain safety, prevent fraud, detect account sharing and investigate suspicious activity;

• calculate and maintain ratings, service-quality indicators and eligibility for platform functions;

• handle support, complaints, appeals, lost property and disputes;

• maintain and improve the Application and platform and diagnose technical issues;

• comply with PLTA, police, court, tax, regulatory or other legal requirements;

• establish, exercise or defend legal claims; and

• send operational and, where lawfully permitted, marketing communications.

6. DATA SHARED WITH CLIENTS AND OTHER RECIPIENTS

6.1. Clients. After an Order is offered or accepted, BroCar may provide the Client with information reasonably necessary to identify the Driver and vehicle and monitor Order progress, such as the Driver’s first name or profile name, photograph where used, vehicle make/model/colour, registration plate, approximate/current location during the Order and a communication method. BroCar will not intentionally disclose unnecessary identity-document, licence or permit details to Clients.

6.2. Technology Provider. Taxsee (Thailand) Co., Ltd. has authorised technical access to the BroCar platform and database for platform operation, maintenance, support and security. To the extent it processes personal data on behalf of Hemia Nao Tek Ltd., it is required to act for authorised purposes and subject to applicable safeguards.

6.3. Hemia Nao Tek Ltd. Authorised personnel of Hemia Nao Tek Ltd. may access Driver data as necessary to operate the Vanuatu service, verify accounts and documents, administer payments, support Drivers, investigate safety/fraud matters and comply with law.

6.4. Authorities. BroCar may disclose relevant Driver information to the Public Land Transport Authority (PLTA), Vanuatu Police Force, courts, tax authorities, regulators or another competent body when required or permitted by law, including for permit verification, safety, law enforcement, regulatory compliance or legal proceedings.

6.5. Service providers. BroCar may use hosting/data-centre providers, payment providers, telecommunications providers, security providers and professional advisers where necessary for the purposes in this Policy, subject to appropriate safeguards.

6.6. BroCar does not sell Driver personal data to advertisers or data brokers.

7. STORAGE IN SINGAPORE AND TECHNICAL ACCESS FROM THAILAND

7.1. BroCar production data is stored on servers located in Singapore. Authorised technical personnel of Taxsee (Thailand) Co., Ltd. may remotely access the database from Thailand to provide technical support, maintenance, security and platform operations. Authorised personnel of Hemia Nao Tek Ltd. also access the system for operation of the Vanuatu service.

7.2. These arrangements involve cross-border processing of personal data generated or collected in Vanuatu and are subject to Part 4 (sections 15–17) of the Data Protection Act.

7.3. Under section 15, personal data generated or collected in Vanuatu must not be used elsewhere without the prior authorisation required by that section unless the destination has been prescribed as providing an appropriate level of protection. BroCar must ensure that the Singapore storage and Thailand access described above are covered by the applicable authorisation or prescribed-destination exception under Part 4.

7.4. BroCar is responsible for obtaining and maintaining any authorisation required by Part 4 for the Singapore storage and Thailand access described above. Where section 17 applies, BroCar must follow the applicable Ministerial authorisation process and conditions, including any explicit, specific and free consent and risk information required as part of that process. Acceptance of this Policy alone is not a substitute for governmental authorisation required by law.

7.5. Cross-border recipients are restricted to authorised purposes and are required to use reasonable confidentiality, access-control, technical, organisational and contractual safeguards.

8. RATINGS, PROFILING AND AUTOMATED DECISIONS

8.1. BroCar may calculate Driver ratings and service-quality indicators using Client ratings, Order completion/cancellation information, complaints, service-rule violations, acceptance/availability signals, safety or fraud indicators and other relevant operational data.

8.2. Ratings or automated signals may influence how Orders are displayed or prioritised, eligibility for certain features, whether additional verification is requested, or whether an account is referred for review. They do not guarantee any number of Orders or earnings.

8.3. Driver ratings and other code-based service-quality scores are calculated automatically and are not manually editable. A Driver may use the Feedback or support channel to ask a human support specialist to review the information underlying an automated decision, consider the Driver’s views and correct inaccurate personal data where applicable. Where section 13 of the Data Protection Act applies, BroCar will provide the safeguards required by that section. Human review does not mean that an automatically calculated rating or score can be manually edited.

9. SPECIAL CATEGORIES OF PERSONAL DATA

9.1. BroCar does not routinely seek special categories of personal data such as race, political opinions, religion, health, sexual life, genetic or biometric data, or criminal-history data merely for ordinary platform use. If special-category information is required for a specific legal, safety or regulatory purpose, it will be processed only where an exception under section 6 of the Data Protection Act applies and with appropriate safeguards.

9.2. A Driver photograph is normally used for identification and service safety. BroCar will not treat it as biometric identification data unless it is subjected to specific technical processing for unique identification within the meaning of the Data Protection Act.

10. AGE AND ELIGIBILITY

10.1. BroCar Driver is not intended for persons under 18. In all cases, a Driver must satisfy every minimum-age, driving-licence, PLTA permit and other legal eligibility requirement applicable to the relevant service in Vanuatu.

10.2. BroCar will not knowingly activate a Driver account where the applicant is legally ineligible to provide the selected service.

11. RETENTION AND DELETION

11.1. BroCar keeps Driver personal data only as long as necessary for registration and account operation, Order records, Personal Account and settlement functions, safety and fraud prevention, support, regulatory compliance, tax/accounting obligations and legal claims.

11.2. When a Driver closes an account, BroCar will delete personal data that is no longer necessary and retain only data that remains necessary for a lawful purpose. Retained data will be limited to the relevant purpose and deleted or de-identified when that purpose ends, in accordance with section 4(5) and section 11 of the Data Protection Act.

11.3. A pending payment, debt, dispute, safety/fraud investigation, government request, licence/permit compliance matter or legal obligation may require temporary retention after account closure.

12. DRIVER RIGHTS

Subject to the Data Protection Act, the Driver may exercise applicable rights, including:

• access to information about processing and personal data under section 9;

• restriction of processing in the circumstances provided by section 10;

• correction of inaccurate or incomplete personal data without delay and free of charge under section 11;

• erasure where section 11 permits it;

• objection to processing under section 12;

• withdrawal of consent where consent is the lawful basis;

• protection from certain solely automated decisions under section 13; and

• representation by another person where permitted under section 14.

BroCar may request reasonable information to verify identity and authority before acting on a request. BroCar will not impose unnecessary formalities and will respond in accordance with applicable law.

13. SECURITY AND PERSONAL-DATA INCIDENTS

13.1. BroCar applies appropriate technical and organisational security measures having regard to the nature of the personal data, the purposes of processing and the relevant risks.

13.2. Access by Hemia Nao Tek Ltd., Taxsee (Thailand) Co., Ltd. and other authorised providers is limited to legitimate operational purposes and subject to confidentiality and security requirements.

13.3. No information system can be guaranteed absolutely secure. This does not remove BroCar’s obligations under Vanuatu law. BroCar will investigate personal-data incidents and make notifications required by the Data Protection Act, applicable Regulations or other binding law.

14. APPLICATION PERMISSIONS AND DEVICE CONTROLS

14.1. BroCar Driver uses device permissions only where required for an enabled function. Location permission is required for Order availability, route and Order-progress functionality while the Application is running. As stated above, BroCar Driver does not collect Driver geolocation after the Application has been switched off/terminated.

14.2. The Driver may control device permissions through operating-system settings. Disabling a permission may limit or prevent the related Application feature.

15. MARKETING AND OPERATIONAL MESSAGES

15.1. BroCar may send messages necessary to operate the Driver account, including Order, document/permit, safety, security, Personal Account and support notifications. These are operational messages.

15.2. Promotional messages are sent only where permitted by law. A Driver may opt out of promotional communications without losing necessary operational or security messages.

16. CHANGES TO THIS POLICY

BroCar may update this Policy when technology, processing practices or law changes. The current version will be published on the legal website. BroCar may also use in-app announcements, push notifications, e-mail or another available channel to draw attention to material changes, but delivery or reading of such messages cannot be guaranteed. Where applicable law requires a specific form of notice or new consent, BroCar will comply with that requirement.

CONTACTS

Service operator / data controller in Vanuatu: Hemia Nao Tek Ltd.

E-mail: vanuatu@brocar.com

Official website: https://bro-car.com/

Legal information: https://legal.bro-car.com/

Requests concerning personal data may be submitted by e-mail. BroCar may request information reasonably necessary to verify the identity or authority of the requester before disclosing or changing personal data.

A Driver may also lodge a complaint with the competent Vanuatu data-protection authority in accordance with applicable law.