We respect and value your privacy. The purpose of this Policy is to provide you with a comprehensive description of our online and offline practices in the collection, use, and disclosure of your personal information, and the rights you have regarding your personal information. This Privacy Policy applies to the website, mobile application products, and services related to DiDi ride-hailing related services (collectively, “DiDi Services”), except for services explicitly announced to adopt independent privacy policies. In this Policy, the terms “DiDi,” “DiDi Group,” “company,” “us,” “we,” and “our” refer to DiDi Group and its affiliates and subsidiaries.

BY USING DIDI SERVICES, YOU AGREE TO BE BOUND BY THE TERMS OF THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH THESE TERMS, PLEASE DO NOT USE DIDI SERVICES.

2. Who This Policy Applies To

This Policy applies to the driver users (users who provide transportation services as an individual), the passengers users (users who request or receive transportation services), and users of other categories (such as the fleet managers) (collectively “users” or “you”) who are residents in the United States or Canada. In addition to this Policy, we will provide separate notification in certain functions of DiDi Services that require us to use your personal information.

3. How We Collect, Use, and Share Your Personal Information

We collect information that identifies, describes, or is reasonably capable of being associated with you (“Personal Information”). Personal Information does not include publicly available information or any data that has been de-identified, aggregated, or otherwise anonymized.

The table below describes the categories of Personal Information we may collect, along with how we use and when we may share each category of Personal Information. We will not use the Personal Information for materially different purposes without notifying you.

We will recognize and determine the countries and regions where you are using our service based on your geographical location, departure, and destination information. If DiDi does not provide DiDi Services in such countries and regions yet, we will timely inform you. You can also learn about where DiDi Services are provided via the announcement on our website (https://img0.didiglobal.com/static/luban_data/webapp-lang-list.html). In the countries and regions where DiDi Services are not yet available, we may only collect the information provided by you when you download our mobile application or create your user account, including your geographical location, the version of the app you use, your mobile phone number, and the identification number and serial number of your device.

Our services are intended for users who are 13 years or older. We do not knowingly collect information from children under 13 years old. If you are a parent or legal guardian and think your child under 13 has given us information, you can contact us through the Help function in our Application or by emailing us at [email protected]. If we learn that we have collected the information of a child under 13, we will delete such information from our records and terminate the child’s user account.

DiDi does not and will not sell your Personal Information to third parties.

Generally, DiDi will retain your Personal Information only for as long as necessary to fulfill the purposes for which it was collected. In some instances, we may be required to retain it longer to comply with legal, accounting, or other reporting obligations.

If you are a resident of Canada or a California resident, you have specific rights over your Personal Information.

Your Right to Know

You have the right to request information about:

• The categories of Personal Information we collected about you;

• The categories of sources from which we collected that information;

• Our business or commercial purpose for collecting that information;

• The categories of third parties with whom we shared that information; and

• The specific pieces of Personal Information we collected about you in the past 12 months.

You also have the right to request a copy of your Personal Information.

Your Right to Deletion

Under certain conditions, you have the right to request that we delete the Personal Information that we have collected about you. If we are not able to verify your request or if we are not legally required to comply with your request, we will notify you of the basis for the denial.

Submit a Request

To submit a request to access or delete your information, you or your authorized representative may contact us through the Help function in our Application or by emailing us at [email protected]. When you contact us, please provide your first and last name, email address, telephone number, and a description of your request.

Designating an Authorized Agent

You may designate someone to make a consumer request on your behalf (“authorized agent”). You must provide us written permission to allow your authorized agent to act on your behalf.

Verifiable Consumer Requests

Before we can provide you with information we will need to verify your identity. Please note the procedures are intended to protect individuals’ privacy. We will verify your information by matching the identifying information you provide us to the Personal Information we already maintain about you. If we are not able to verify your request we will contact you for more information, or we may deny the request and we will explain the basis for the denial.

Sharing Personal Information With Third Parties For Their Own Direct Marketing

You may ask us one time each year if we have shared your Personal Information with third parties for their direct marketing purposes. If we have, we will provide you with the categories of Personal Information we shared and the names and addresses of third parties that received your Personal Information. To submit a request, you may contact us through the Help function in our Application or by emailing us at [email protected]. Please indicate that you are a California resident making a “Shine the Light” inquiry or a resident of Canada and making a request pursuant to PIPEDA or a substantially similar provincial law.

Usage Data and “Do Not Track” Requests

DiDi collects activity data for internal operational improvement and quality purposes. DiDi’s technology does not recognize “Do Not Track” browser signals because doing so would interfere with the functionality of our application.

DiDi will not unlawfully discriminate against you for exercising any of your rights. If you have questions or concerns about any type of discrimination or retaliation, please contact us through the Help function in our Application or by emailing us at [email protected].

Certain Personal Information is accessible in the mobile application at any time through the following means:

• Account. You may click the profile on the side bar of DiDi mobile application, to access the Personal Information you provide.

• Order. You may access your trip information, order information, and trip status through “My trips” on the side bar of DiDi mobile application.

• Safety. You may access the emergency contact you set through “Safety Center” on the side bar of DiDi mobile application.

• Payment. You may check your balance, reward points, set-up of payment methods, payment records, coupons and cards through “Payment” on the side bar of DiDi mobile application.

You may edit or supplement your Personal Information through the following means:

• Account. You may correct or modify your Personal Information via your DiDi account.

• Settings. You may correct or modify your password, usual address, emergency contact and other information through Settings of DiDi mobile application.

• Payment. You may correct or modify your payment methods, bank account number and other information through “Payment” of DiDi mobile application.

• Other than the above means, you may also send your request to us via email.

You may request withdrawal of your consent through the following means:

• In the advertisements we send to you, you will be informed of the ways to unsubscribe from advertising or marketing information;

• You can disable your authorization to DiDi through your device settings;

• You may withdraw your authorization by unlinking bank cards and deleting information on the personal homepage, etc.

You may also request assistance with managing the information in your account by contacting us through the Help function in our Application or by emailing us at [email protected].

Nothing in this Policy will restrict DiDi’s ability to otherwise:

• Comply with federal, state, provincial, or local laws;

• Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities;

• Cooperate with law enforcement agencies concerning conduct or activity that the business, service provider, or third party reasonably and in good faith believes may violate federal, state, or local law; or

• Exercise or defend legal claims.

This Policy is reviewed and updated annually to ensure it accurately captures our practices and procedures. The effective date of each version of this Policy is identified below. If we make any changes to this Privacy Policy that significantly affect your rights, we will let you know via email and/or a prominent notice on the company’s website, and/or other reasonable means prior to the changes becoming effective. You are advised to review this Privacy Policy periodically for any changes. Your use of DiDi Services after we have made changes to this Privacy Policy will mean that you have accepted those changes.

If you have questions or concerns regarding this Policy or the handling of your Personal Information, please contact us through the Help function in our Application or by emailing us at [email protected].

Effective January 1, 2020