This app shall be hereinafter referred to as “DiDi Passenger”.

An individual who accesses, browses or uses DiDi Passenger or any DiDi websites in connection with the DiDi Passenger shall be hereinafter referred to as the “User”.

DiDi and, in certain countries, its affiliates, provide, using a technological platform, intermediation services between Users and Passenger (the “DiDi’s Services”) to enable the User, according to its mobility needs to arrange and plan online the direct provision of mobility and logistics services by the independent third parties (the “Driver Partners”) who provide mobility services (the “Mobility Services”) as well as logistics services (the “Logistics Services”, and collectively with the Mobility Services, the “Services”).

The User who has been assigned, for a ride, a Driver Partner (hereinafter the “Appointed Driver Partner”) through DiDi Driver shall be hereinafter referred to as the “Appointed User”.

The Passenger acknowledges that the Company does not provide the Services and that the Company does not operate as a mobility company. The Services are directly provided by the Appointed Driver Partner, who is an independent third party and does not act as an employee of the Company or any of its affiliates.

This DiDi Passenger Privacy Notice (hereinafter the “Privacy Notice”), along with DiDi Passenger Terms and Conditions, sets forth the relevant conditions for the processing of the Passenger’s Personal Information (as defined below).

Please read this Privacy Notice carefully before using DiDi Passenger so you can understand the considerations and practices related to the Passenger’s Personal Information and how such information will be processed.

1. Personal Information Processing

“Personal Data” shall mean any information identifying an individual and used by such individual for identification purposes (individually or collectively with any other information). For the purposes of this Privacy Notice, Personal Data shall include, among other information, name, mobile number, photo, address, location, access data, searches, device data, telecommunication carrier, and IP address.

“Financial Data” shall mean any information about debit or credit cards or any other payment method, bank accounts, invoices, payment receipts, and any information about tax identification as may be relevant to DiDi regarding the use by the User of DiDi Passenger and the provision of the DiDi’s Services.

“Sensitive Personal Data” shall mean any information relating to the most private or intimate social sphere of the data subject or that information that, if is inadequately processed, might lead to discrimination and pose a risk to the data subject. Whenever required by the applicable laws, DiDi may obtain the express consent of the Sensitive Personal Data subject.

Personal Data, along with Financial Data and Sensitive Data, shall be hereinafter referred to as the “Personal Information”.

DiDi owns and operates DiDi Passenger; therefore, DiDi shall be entitled to collect, disclose, store, use, process, share, transmit, transfer and protect the User’s Personal Information in accordance with this Privacy Notice and the applicable laws.

Before providing any Personal Information, the User shall be aware and agree to the processing purposes related to the use of DiDi Passenger.

If the User fails to provide the requested Personal Information, the User might be unable to access to DiDi Passenger, in whole or in part.

2. Purposes for the Processing of Personal Information

2.1 DiDi shall be entitled to process, among others, the following Personal Information:

2.1.1 User’s Information

The User shall, as required by DiDi, provide their name, mobile number, ID number, e-mail address, among other relevant information to recognize the User’s identity, so that the User can use DiDi Passenger.

DiDi shall process such information in accordance with the laws and regulations, aiming to ensure User’s personal safety and the safety of their goods. If the User fails to provide such information, the User may not have full access to the provision of the Services and DiDi’s Services.

DiDi may process the User’s information with the objective of conducting calls, sending SMS, or other kind of messages supported on automated systems for purposes such as assistance on the completion of the registration process (if applicable), marketing operations, customer loyalty and others similar.

2.1.2 Any Other User’s Information

The User shall provide, as required by DiDi, among other information, their photo and address to be enabled to use DiDi Passenger.

In the event that the User provides their photo and facial recognition characteristics, DiDi shall process such Personal Sensitive Data in order to comply with any applicable fraud prevention or safety obligations or with any public safety laws, or to take any legal action or defend any claim, or to meet any requirements from the authorities, or for any other purposes previously notified to the Users.

In any case, DiDi shall only process the sensitive data provided by the User in compliance with the applicable law. Under certain circumstances, given the processing purposes regarding photos and facial recognition characteristics, if such information is not provided, the User shall not be able to continue using DiDi Passenger.

In connection with the use of DiDi Passenger by the User, DiDi shall process the User’s location data whenever DiDi Fleet is running in the foreground (app open displayed on-screen) or background (app open but is not displayed on the screen) on the User’s mobile device. DiDi shall get the User’s location through the IP address, GPS and other sensors that provide relevant information (e.g., data about nearby devices, Wi-Fi access points, and base station data).

2.1.4 Trips

DiDi shall process any information about the User’s ride start and destination points, as well as the route, distance, and ride duration. DiDi shall process such information following the applicable laws and regulations for the User’s personal safety and the safety of their goods, as well as to settle any conflicts in accordance with the DiDi Passenger rules.

2.1.5 Call Data

DiDi might record and process the contents of the User’s incoming and outgoing calls and messages on DiDi Passenger exchanged with Driver Partners, DiDi representatives or any other individual concerning the Services and DiDi’s Services, including, but not limited to, the call duration, and the phone numbers of the parties. DiDi shall keep that information to verify any facts and respond to any complaints in case of conflicts or accidents involving the User. The foregoing to the extent of the applicable legislation.

2.1.6 Order and Transaction Status

DiDi might record the User’s order and transaction status on DiDi Passenger. DiDi shall process such information in accordance with the applicable laws and regulations for the personal safety of its users and the safety of the goods of such users, as well as to have evidence in case of any conflicts.

2.2 Rating Information

Whenever it is applicable, the User may rate the Appointed Driver Partner anonymously on DiDi Passenger. For this purpose, the User shall not provide any Personal Information. Otherwise, any provided information, in this case, might be disclosed to the Appointed Driver Partner.

DiDi may receive and store the User’s Financial Data to charge and transfer money to the User’s specified account in the terms set forth in DiDi Passenger Terms and Conditions and for any other purpose relating to payment facilitation during the use of DiDi Passenger.

2.4 Customer Service

Whenever the User contacts the customer service team, DiDi shall record the User’s call data, comments or suggestions, name, contact details and any other information provided by the User by recording the call or message or recording the information manually, so that DiDi may, at its discretion, help settle any conflicts, comments or suggestions or give feedback to the User. If the User denies DiDi the collection of such information, this may result in DiDi customer service team failing to meet the User’s requirements; however, the use by the User of the main business features of DiDi Passenger shall not be affected nor shall the User be prevented from exercising their rights as a DiDi User.

2.5 Data Analysis

In order to improve the DiDi Passenger Services and provide the User with other more customized and convenient services, DiDi shall collect the User’s access data, searches, IP address, device information (including model, ID code, OS, and telecommunication carrier), and location. DiDi shall use a browser storage and cache memory mechanism to process the information on the User’s device. DiDi might obtain the User’s consent to process such information whenever it is required under the applicable regulation. In the even that DiDi asks the User for their consent to process this information, the User shall be entitled to withdraw their consent by contacting DiDi at any time.

2.6 Third-Party Services

Whenever the User uses Third-Party Services, DiDi shall process the User’s necessary Personal Information (including any information provided by the User and any information recorded by the system) and will share it with the third party providing such Third-Party Services, including DiDi’s service providers or business partners who carry out DiDi’s business operations, so that they are able to provide the User with the contracted Third-Party Services. If the User denies the processing of such information, the User may probably not be able to receive such Third-Party Services through DiDi Passenger. However, such refusal shall not affect the use by the User of the main features of DiDi Passenger. The Third-party that provides the Third-Party Services shall only use the User’s information for the purposes of providing such services. Some of the Third-Party Services may include collection and payment activities, among others.

3. Device Permissions

3.1 DiDi Passenger may ask the User to set certain permissions on their device. Upon using or accessing DiDi Passenger, that act will be considered as granting access to DiDi to their device.

3.2 The User may revoke all or any of the permissions on their device to prevent DiDi from collecting any relevant Personal Information. How permissions are applied may vary on the various devices. To get detailed information about your device and its OS, you are advised to contact its developers.

4.1 Personal Information Storage Period

4.1.1 DiDi shall keep the User’s Personal Information as long as the User has a DiDi Passenger account.

4.1.2 The User may cancel their DiDi Passenger account directly through the app or by contacting DiDi customer service. DiDi shall keep the User’s Personal Information as deemed necessary under the applicable law or regulations or for the purposes of protecting the User’s personal safety and the safety of their goods, except where the User expressly requests DiDi not to keep such information.

4.1.3 If the User wishes to delete their Personal Information, the User may contact DiDi customer service to make that request. DiDi shall delete the User’s Personal Information, following the business practice, within a reasonable period of time, pursuant to the applicable laws and regulations.

The User agrees that, in accordance with the applicable laws and regulations, the User’s Personal Information processed by DiDi shall be transferred, transmitted and stored in data centers in the United States of America or anywhere else around the world where there are entities controlled by DiDi and its affiliates, as applicable. In the case of data transmitted to a third party, the information shall only be used for the purposes described in this document.

5. Use of Personal Information

5.1 The User acknowledges and agrees that their Personal Information may be used in any cases directly or reasonably related to the purposes specified in the “Personal Information Processing” section above. The User particularly acknowledges and agrees that:

a. DiDi may analyze the Personal Information to provide the User with more customized and convenient services.

b. DiDi may design, develop and promote new products and services available for the User’s use, based on their Personal Data statistics.

c. DiDi may analyze the User’s anonymized Personal Information and share the statistics with the public or a third party for the purposes of the DiDi Passenger operations.

d. DiDi shall send information and notices to the User using various channels, including, but not limited to, verification codes, any necessary notices regarding the use of the products or services, news about DiDi Passenger services, as well as any marketing activities and special promotional information, and third-party promotional information in cooperation with DiDi Passenger or any other content the User may be interested in, if previously authorized by the User, according to the information provided by the User. If the User does not wish to continue receiving such information, the User may opt-out by unsubscribing.

5.2 In the event that DiDi needs to use the User’s Personal Information beyond the scope directly or reasonably related to the purposes of this Privacy Notice, DiDi shall notify the Users and obtain their authorization.

6. Personal Information Sharing, Transfer and Publicity

6.1 The User acknowledges and agrees that DiDi shall keep confidentiality over the User’s Personal Information in accordance with the applicable laws and regulations. DiDi shall not transfer or transmit the User’s Personal Information to any other people, except in the following cases:

i. DiDi may share the User’s Personal Information in fulfilling DiDi’s administrative purposes as well as for DiDi’s affiliates’ and subsidiaries’ internal reporting. In any case, such disclosure shall be provided on confidentiality terms that shall not be less restrictive than stated in this Privacy Notice.

ii. DiDi may share the User’s Personal Information with DiDi’s service providers and business partners who carry out DiDi’s business operations so that they are able to provide the User with DiDi’s Services through DiDi Passenger. For example, DiDi might share the User’s information with the Appointed Driver Partner, which might include the phone number, and other Personal Information that Passenger requires

iii. DiDi may share the User’s Personal Information to provide services in cooperation with a third party such as DiDi’s services providers and business partners (hereinafter referred to as “Collaborators”). To improve DiDi’s Services, DiDi may share the User’s Personal Information with DiDi’s affiliates, Collaborators and their affiliates; provided that any such disclosure is provided on confidentiality terms that shall not be less restrictive than stated in this Privacy Notice.

iv. DiDi may transfer or transmit the User’s Personal Information to any service providers and other partners who globally support DiDi operations, e.g., by providing DiDi with technical infrastructure services, criminal investigation services, analysis of how DiDi’s Services are used, assessment of the DiDi Passenger effectiveness, customer services, or by facilitating and processing payments. In the context of the agreements entered into with DiDi, such third parties have strict confidentiality obligations in keeping with this Privacy Notice. In this case, the Personal Information shall only be used for the purposes stated herein.

v. Whenever the User uses third-party services, as described in item 2.7 above (“Third-Party Services”) through DiDi Passenger, DiDi may share the User’s Personal Information with the Third-Party Service provider, who shall only use such data for the purposes described herein, notwithstanding the possibility that such third party may obtain the User’s authorization to use such Personal Information in accordance with their own terms and conditions and privacy policies.

vi. For the purposes of protecting the User’s rights and interests, for the purposes of settling any conflict regarding DiDi operations or for any other purposes, DiDi may disclose the User’s Personal Information to any administrative or judicial authorities, pursuant to the applicable laws and regulations.

vii. To the extent permitted or required by the applicable laws and regulations, DiDi may disclose the User’s Personal Information necessary to protect the public interest. Upon agreeing to this Privacy Notice, the User acknowledges and agrees that DiDi or any of DiDi’s related companies may transfer the User’s Personal Data to any authorities and public investigation entities, as specified in the “Purposes for the Processing of Personal Information” section above, with the purpose of agreeing upon strategies that will allow for the successful analysis, investigation and criminal prosecution of various criminal phenomena associated with mobile apps that provide similar services to DiDi’s Services. The Personal Information expressly authorized to be transferred to such public entities include the date of registration and the date of the most recent trip, name, mobile number, e-mail address, bank account information, only regarding the bank name and type of bank product and government-issued ID (a card or similar), profile photo, as well as any location data and trip data (including the User’s start point, trip start point, requested trip endpoint, actual trip endpoint, route map, date and time), among others.

viii. DiDi may share the User’s Personal Information on the terms of this Privacy Notice.

ix. Any others allowed by the User.

6.2 DiDi shall not disclose the User’s Personal Information to a third party not specified in this Privacy Notice, except upon the prior express consent of the User. In that case, DiDi shall enter into an NDA with the third-party with whom the User’s Personal Information may be shared, requiring such third-party to take any necessary security and confidentiality measures in processing the Personal Information.

6.3 DiDi shall keep the User’s Personal Information under safety and confidentiality conditions, in accordance with the applicable laws and regulations. DiDi shall not publicly disclose the User’s Personal Information, except where the User may have previously given their express consent or authorization, or pursuant to the applicable laws and regulations.

6.4 In the event of any acquisition, merger, restructuring, among other corporate changes, DiDi shall require its successor to comply with this Privacy Notice. Should DiDi’s successor need to change the use purpose of the Personal Information, DiDi’s successor shall obtain the prior express consent of the User.

7. Use of Financial Data

DiDi shall not transmit or transfer the User’s Financial Data to a third party, except for any service providers who conduct payment processing operations or provide any other applicable financial services, or DiDi’s affiliates on a need-to-know basis for the purposes of the provision of DiDi’s Services, except for any cases expressly detailed in this Privacy Notice.

8. Rights of the Users

The User shall have the rights provided under the applicable law, and particularly the rights provided under this Privacy Notice, which shall be exercised through DiDi Passenger as follows:

8.1 Access

The User may access their Personal Information on DiDi Passenger as follows:

a. Account

The User may access their Personal Information and any other information provided through their account on DiDi Passenger.

b. Trips

The User may access information about any trips completed, transaction status on DiDi Passenger and, in general, DiDi operations, through DiDi Passenger.

Whenever this functionality is available, the User may access any of their Financial Data, including any payment methods and records, and any other corresponding information, using the DiDi Passenger Wallet.

d. Other Personal Information

Should the User need to exercise their right to access any other information, the User may contact DiDi customer service at any time.

The User is entitled to have their Personal Information corrected and updated. The User may correct or modify their Personal Information on DiDi Passenger upon a correction or update request sent to DiDi customer service or in any of the following ways:

a. Account

The User may correct or update their Personal Information and any other information provided through their account on DiDi Passenger.

The User may correct or update their password and any other information about their settings as a User using the DiDi Passenger settings function.

The User may correct or modify any of their Financial Data, including any payment methods and records, and any other corresponding information, using the DiDi Passenger Wallet, provided that such functionality is available.

d. Other Personal Information

Should the User need to exercise their rights to correct or modify any other information, the User may contact DiDi customer service at any time.

8.3 Objection

DiDi gives the User the right to have their consent revoked, as follows:

a. The User shall be entitled to revoke the authorization given to DiDi to access their Personal Information and Sensitive Personal Data, using their device settings to revoke the corresponding permissions (including location, address book, photo, microphone, camera, notification, etc.).

b. The User shall also be entitled to revoke any part of the authorization given to DiDi by deleting their Financial Data, e.g., the bank card data, among others.

Whenever the User revokes their consent or authorization, DiDi may not continue to provide the User with the services associated with the Personal Information related to the revoked authorization. However, the User revoking their consent or authorization shall not retrospectively invalidate any Personal Information processing previously completed by DiDi under such consent given by the User before revoking it.

If the User cannot directly access, rectify, cancel or delete their Personal Information or revoke their consent, the User may contact DiDi customer service online or via phone call using the “customer service” function.

9. Data Shared by the User

9.1 The User may share their location, trip conditions, and any other information about DiDi Passenger services with a third party.

9.2 Whenever the User shares their location, trip conditions and any other Personal Information with any other individuals or outside service providers, or uses such information along with the Third-Party Services or through Third-Party Services links, the User might directly disclose their Personal Information or allow third party access to such Personal Information. In this case, for the purposes of the processing conducted by the owners of the Third-Party Services, the Privacy Notice of such third parties the User voluntarily agrees to share their information with shall apply, without DiDi being responsible for the Personal Information processing conducted by such third parties.

9.3 DiDi recommends that, before agreeing to share information with a third party other than DiDi, the User reads the Privacy Notice of the Third-Party Service providers to understand the conditions under which the User’s Personal Information will be processed. The User shall be responsible for any consequences of providing or sharing their Personal Information with such third parties or any other individuals when using Third-Party Services. In addition, such third parties shall be liable for the processing of the data provided by the User in accordance with the applicable law or regulations.

9.4 If the User publicly discloses any information through DiDi Passenger, anyone with access to the app may see or access such information. Since any information publicly disclosed by the User when using DiDi’s Services may include the User’s or other individuals’ Personal Information, the User must assume its own responsibility and, as far as possible, prevent from disclosing their own and third parties’ Personal Information.

10. Changes

10.1 Should any of the following changes be made in DiDi Passenger operations, DiDi shall promptly make the corresponding modifications to this Privacy Notice:

a. Changes in DiDi Passenger business functions.

b. Changes in the rules of use of the User's Personal Information.

c. Changes in DiDi’s contact details and complaint channels.

d. Other changes that may affect the security of the User’s Personal Data or rights to privacy.

10.2 DiDi shall not modify the conditions for the Users to exercise their rights under this Privacy Notice, without the express consent of Users.

10.3 Where any adjustments to this Privacy Notice or to the purposes for the processing of Personal Information may be required, any such adjustments shall be notified to the User before making them, with the User being entitled to revoke the authorization provided to DiDi to manage their Personal Information.

10.4 Except as otherwise stated, the updated Privacy Notice shall become effective upon release.

11. Annexes

DiDi shall be entitled to freely decide on any annexes for every territory where DiDi conducts business and set special rules applicable thereto. As a general rule, this Privacy Notice shall prevail over any such annexes. Nevertheless, if due to specific local rules it is necessary for the annexes to prevail over the Privacy Notice, then this situation will be made express in the respective text of the annex.