Global Privacy Notice for Clients and Couriers

• ABOUT BOLT AND THIS POLICY

• WHAT TYPES OF CLIENT PERSONAL DATA WE COLLECT AND PROCESS

• CLIENT PERSONAL DATA RETENTION

• WHAT TYPES OF PERSONAL DATA OF INDIVIDUALS PROVIDING COURIER SERVICE WE COLLECT AND PROCESS

• COURIER PERSONAL DATA RETENTION

• HOW AND WHY WE USE THIS PERSONAL DATA

• AUTOMATED DECISION MAKING

• DIRECT MARKETING

• DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

• HOW WE PROTECT YOUR PERSONAL DATA

• INTERNATIONAL TRANSFERS OF PERSONAL DATA

• YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

• THIRD PARTY LINKS

• QUESTIONS AND UPDATES

ABOUT BOLT AND THIS POLICY

Bolt Operations OÜ, trading as “Bolt” (a limited company registered in Estonia, with company number 14532901, registered office in Vana-Lõuna tn 15, 10134, Tallinn, Estonia) (hereinafter referred to as “Bolt” or “we”) is the data controller of your personal data.

Bolt collects and processes personal data in the course of installation and use of the Bolt Food app by Clients and Bolt Food Courier app by Couriers and in relation to registration and on-boarding and provision of services, in accordance with the relevant terms of use.

Please note that the processing of geographical location data is generally necessary for use of the Bolt Food Platform by Clients and Couriers. Bolt may also collect personal data about individuals that interact with us, including by browsing our websites and using our apps. By using our websites, apps and services, you acknowledge that we process your personal data in accordance with this privacy policy.

Should you have any questions or concerns relating to this privacy policy or your personal data, you can contact us at contact details provided in sections “Questions and Updates” below.

WHAT TYPES OF CLIENT PERSONAL DATA WE COLLECT AND PROCESS

Personal data is generally processed in order to provide the service contracted with Bolt Food. We collect the following types of personal data about the Client (both directly and indirectly from third parties, such as from Bolt Business Customers):

• biographical and contact information including name, telephone number, e-mail address, as collected during installation of the app;

• identification/verification data such as government-issued document information (for example, ID card, driving license, passport, or residence permit issued by any country) and photos;

• information related to Order(s) made via Bolt app and information related to each Order made (special requests regarding ordered Meals, for example cooking preferences, information about allergies, if the Client decides to provide such information etc), food preferences, etc.;

• geographic location from where you access and use the app from and to what location you order the Meal (this is required for the service);

• where you register for an account, your user ID and password and associated account information such as your preferences and any applicable promo codes;

• where you choose to connect to the service from a third party service, such as Facebook, your information from that service;

• feedback ratings (including information provided to resolve disputes);

• payment information and payment history;

• information regarding your requests to order Meals when you are the Client/ your acceptance to deliver Meals when you are the Courier, including geographical location, the time of provision of service, details of the route of delivering the Meal and destination; price paid and other order history;

• text, images and other user content you provide;

• If we ban or suspend you from use of the service, a record of that ban or suspension;

• identification data of the device on that you have installed;

• website and communication information such as details collected by cookies and other similar tracking technologies when you use our sites or apps;

• details of support queries you make (e.g. through our apps or via other communication channels), including record of any reported lost items; and

• where we reasonably suspect fraud, details of offences or alleged offences from fraud detection and prevention agencies.

CLIENT PERSONAL DATA RETENTION

Your personal data will be stored as long as you have an active account. If your account is closed, personal data will be deleted, securely destroyed or anonymised (according to the policies set out in this section) from the databases, unless such data is required to be retained for legal or regulatory purposes or certain legitimate business purposes, including for accounting, dispute resolution or fraud prevention.

This follows that:

• Data related to each Order will be stored for a maximum of 3 years as of the performance of each Order, unless your Bolt app is deleted by us before that.

• Identification/verification data and verification results will be stored for a maximum of 2 years from the date of account deletion to handle any legal or regulatory claims.

• Data required for accounting purposes will be stored for 5 years after the performance of each Order.

• If the Bolt app has not been used for 3 years, we will notify you and ask you to confirm whether the account is still active. If no reply is received, the account will be closed and personal data will be deleted, securely destroyed or anonymized unless such data is required to be stored for certain legitimate business purposes including for accounting, dispute resolution or fraud prevention purposes within the following 12 months.

• In the event that there are suspicions of an administrative or criminal offence, fraud or false information having been provided, the data will be stored for 10 years.

• In the event of disputes or investigations, data will be retained until the claim or investigation is satisfied/resolved or the expiry date of such claims.

Please note that the uninstallation of the Bolt app from your device does not cause the automatic deletion, destruction or anonymization of your personal data.

WHAT TYPES OF PERSONAL DATA OF PRIVATE INDIVIDUAL COURIERS WE COLLECT AND PROCESS

Personal data is generally processed for the performance of the contract concluded with the Courier. We collect the following types of personal data private individual Couriers (both directly and indirectly, such as from third-party sources and publicly available information):

• biographical and contact information including name, telephone number, e-mail address;

• banking or financial information and payment information;

• geographical locations when Couriers are logged into the app (this is required for the service);

• demographical data;

• account information including user ID;

• details of performed Orders, journeys and feedback ratings and duration of provision of journeys on each day;

• fare estimates, actual fares and other payment data;

• earnings history and fiscal data;

• text, images, and other user content you provide;

• if we withdraw your right to use the service, issue a warning, a record of that withdrawal or warning;

• identification data of the device on which the relevant Bolt app has been installed;

• website and communication information such as details collected by cookies and other similar tracking technologies when you use our sites or apps. Details of support queries you make (e.g. through our apps or via other communication channels);

• Client complaints related to the deliveries performed by the Courier;

• background checks information in accordance with local requirements, which may include medical certificates, topographical test certificates and/or language test certificates;

• data regarding criminal convictions and offences if allowed or necessary under applicable law;

• information collected from third parties about you in order to verify any information you supplied to Bolt during registration;

• record of any requests for your information made by law enforcement, regulatory, governmental or judicial bodies

We collect and process personal data of Couriers to ensure regulatory compliance, for verifying the Courier’s qualifications for pursuing this professional activity of delivering food and safeguarding the contractual relations associated with the Bolt app service, including resolving any delivery service quality issues and monitoring your compliance on an ongoing basis.

Bolt’s operations team can see the geographic location of a Courier, information on dispatches and the times of using the service.

COURIER PERSONAL DATA RETENTION

Your personal data will be stored as long as you have an active Courier account, unless your personal data is required to be retained for certain legal or regulatory purposes, or legitimate business purposes including accounting, dispute resolution or fraud prevention purposes. This follows that:

• If your account will be closed the personal data will be stored for an additional 3- year period.

• Data necessary for accounting purposes shall be stored for 7 years.

• In the event of suspicions of an administrative or criminal offence, fraud or false information, the data shall be stored for 10 years.

• In the event of disputes or investigations, the data shall be retained until the claim or investigation is satisfied/resolved or the expiry date of such claims.

After we no longer need your personal data, it will be deleted, securely destroyed or anonymized (according to the policies set out in this section) from the databases. Please note that the uninstallation of the Bolt app from your device does not cause the automatic deletion, destruction or anonymization of your personal data.

HOW AND WHY WE USE THIS PERSONAL DATA

Bolt collects and uses personal data for purposes of providing the Bolt Food and Bolt Food Courier apps and for Bolt’s legitimate business purposes. These include the purposes set out below.

Under EU data protection laws, Bolt’s use of personal data must be justified by one of a number of legal bases. These are also set out below.

To deliver our services to you (lawful basis: to perform and fulfil our contracts with you; and for our legitimate interests (to provide our services to you).

• We may use personal data to provide our Bolt Food and Bolt Food Courier apps, to create and manage your user accounts and to allow you to provide feedback.

• Where you are a Client, to forward your Meal Order to the respective Restaurant accept your Meal Order request and for enabling you to conclude a Meal preparation contract with the Restaurant.

• Where you are a Client, to find and allocate the Courier to fulfil the delivery of your Meal Order request. This information (including geographical information) is provided to the Courier.

• Where you are a Client, once you have made a Meal order via Bolt app, additional information is provided to the Restaurant and/or to the Courier to facilitate communication (see section “Disclosure of personal data” for further information).

• Where you are a Courier, we use your personal data to on-board you as a courier service provider and to facilitate interactions with Clients including to enable you to decide whether to fulfil a Client’s requested delivery and once a delivery has been allocated, to facilitate communication with the Client (see section “Disclosure of personal data” for further information).

• Where you are a Courier, to allocate Client Meal Order requests based on your geographical location.

• We may use personal data to facilitate payments between Clients, Restaurants and Couriers.

• We may use personal data to provide support, including to assist with resolving service quality issues and to respond to queries from Clients, Restaurants and Couriers.

• We use contact details to notify you of updates to our websites and the Bolt apps.

To undertake checks where permitted by applicable law (lawful basis: legal obligations; legitimate interests (to comply with legal or regulatory requirements and provide a safe service); legal claims; and substantial public interest (processing to prevent or detect a crime)).

• We use personal data in our efforts to prevent fraud, including fraudulent payments. If false or inaccurate information is provided and fraud is identified or suspected, your personal data may be passed to fraud prevention agencies and may be recorded by us or by them.

• In certain jurisdictions we may send data about earnings to tax authorities or other relevant authorities.

For research and development purposes (lawful basis: legitimate interests (to allow us to improve our services)).

• We may use personal data to improve our websites and apps (including their security features) by analysing it to better understand our business and services. For example, we collect data of the routes taken by the Bolt app users to analyse the geographic coverage in order to make recommendations to the Couriers or to engage new Restaurants.

• In order to assist with this, we may apply profiles to you based on your personal data and behavioral information (such as the pages on the website or apps you have visited or interacted with, including by reference to personal data legitimately obtained and shared with us by third parties or publicly available data). Such profiles may be used as part of our advertising, analytics and provision of support.

• We may use personal data provided from surveys or feedback to assist with this.

To provide you with marketing materials or provide you with offers from our partners (lawful basis: consent, legitimate interest (where we are not required to rely on consent, to keep you updated with news in relation to our products and services and to enable us to analyse how you interact with our communications).

• Where permitted by law (you will always be provided with an opportunity to opt-out of future messages), we may contact you with promotional messages regarding the Bolt app and our and selected business partners’ products and services. For further information about marketing and how to manage your preferences, see the section “Direct Marketing to Users” below.

• Where you have expressed the interest to participate in the campaign organized by our partners we may share your personal details with them if it is necessary to conduct such a campaign.

• We may use cookies and other tracking technologies to understand and analyse your online experiences and to determine what events, products and services are likely to be of interest to you. This may be by reference to how you have interacted with our websites, apps, or marketing emails. We may combine such information (whether you are logged in or not) with personal data.

To reorganise or make changes to our business (lawful basis: legitimate interests (in order to allow us to change our business)).

• In the event that we: (i) are subject to negotiations for the sale of our business or part thereof to a third party; (ii) are sold to a third party; or (iii) undergo a re-organisation, we may need to transfer some or all of your personal data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analysing any proposed sale or re-organisation.

• We may also need to transfer your personal data to that re-organised entity or third party after the sale or reorganisation for them to use for the same purposes as set out in this policy.

AUTOMATED DECISION MAKING

We may undertake automatic analysis of your personal data to make certain decisions on an automated basis without human intervention. Using automated decision-making is less error-prone, more efficient and safer than using our employees. This may include decisions around:

• Allowing you to use, or to continue to use our app and services - we may use information relating to the outcome of background checks, verification processes and behavioral analysis (such as where your behavior appears to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity) to automatically decide whether we will allow you to use our apps and services, or to automatically stop you from using our apps and services. We do this on the basis that it is necessary to enter into a contract with you, or that it is within the substantial public interest (processing to prevent or detect a crime).

• Pricing – we may use information relating to your location and timestamps, the estimated duration and distance of journey related to deliveries of the Meal Orders, the number of concurrent Clients and Couriers using the app and our services within the vicinity, estimated traffic and other related information to determine the estimated duration of journeys related to deliveries.

• Complaint resolution - we may use the complaints information you provide to our customer support team via our chat function. The information relating to your complaints may be used to generate an automated response which will then be evaluated by a human agent to make the final decision.

In relation to each of the instances of automated decision-making referred to above, you have the right to human review the decision; to object to the processing of your personal data for automated-decision making purposes as set out in section “Your rights in relation to your personal data”; to express your point of view; and to contest the outcome of the decision.

Please note that certain exceptions and limitations may apply to your right to object to automated decision-making, as permitted by applicable laws and regulations. We will provide you with clear information regarding the implications of exercising your rights and the processes involved in objecting to automated decision-making.

We may reject the request, as permitted by applicable law, including when providing the information would result in a disclosure of a trade secret or would interfere with the prevention or detection of fraud or other crime. However, generally in these circumstances, our response will be limited to verifying (or requesting an applicable third party to verify) that the algorithm and source data are functioning as anticipated without error or bias.

For more information about the rights you may have under applicable data protection law (and how to exercise these), please see the section below titled “Your rights in relation to your personal data”.

DIRECT MARKETING

We may contact you with promotional messages regarding the Bolt app and our selected business partners’ products and services by email, SMS, phone, social media and where required by law, we will ask for your consent at the time we collect your data to conduct any of these types of marketing on our website or in the Bolt app.

If you no longer wish to receive direct marketing messages, please click the “Unsubscribe from direct marketing messages” link in the footer of our marketing message. You can also opt=out through the Profile section of Bolt App, or by contacting us at the contact details specified below in the section “Questions and Updates”.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

GENERAL DISCLOSURE OF PERSONAL DATA

Bolt shares and discloses your personal data to third parties for the purposes and lawful bases set out in the section above titled “How and why we use this personal data”. These third parties may include Restaurants where the Client orders Meal, Couriers who deliver Meals, other service providers, advisors, our partners and our group companies.

We can also share information related to the Order with Bolt Business Customer when the Client uses the Bolt Business Customer account as a payment method for the services.

DISCLOSURE OF PERSONAL DATA FOR LAW ENFORCEMENT AND CLAIMS

Bolt is committed to ensuring the safety of all clients and couriers using our service. We take all reports of misconduct seriously and we reserve the right, at our discretion, to volunteer information to third parties (including between drivers and passengers), law enforcement, regulatory, governmental or judicial bodies where required by applicable law or regulation or where we feel is necessary.

If we are made aware that third parties, law enforcement, regulatory, governmental or judicial bodies require information about your personal data for an administrative or criminal investigation or in relation to legal claims we will comply as required by applicable law or regulation or to the extent that their request is reasonable and we are able to supply such personal data.

Personal data that we may provide may include:

• name(s);

• date of birth (if available);

• contact number;

• home address (if available);

• details about the Orders and Meals ordered, including food preferences; and

• details of the complaint made by the Client, Courier, or applicable third party.

Bolt may, at our discretion, provide you with notice that we have provided such third parties, law enforcement, regulatory, governmental or judicial bodies with your personal data.We reserve the right to proactively initiate police reports if we become aware of action or behaviour that may constitute a threat to safety or is of a criminal concern.

DISCLOSURE OF PERSONAL DATA AS BETWEEN CLIENTS AND COURIERS

The personal data of Couriers is disclosed to Clients once the Courier has accepted the request for delivery service and contract for delivery service is concluded between the Client and the Courier. The Client will see the Courier’s name and geographic location of the Courier. At the same time, the personal data of Client disclosed to the Courier with whom the Client concludes the contract for delivery service. Via Bolt app, the Courier will see the first name and first letter of the last name of the Client, geographic location of the Client and information of the Order for the Meal made by the Client (including the Restaurant where the Meal was ordered) and contact phone number of the Client.

Pursuant to data sharing agreement concluded between the Courier and Bolt, after providing the delivery service, the Courier is entitled to retain the Client data related to the performance of the delivery service for the maximum period of 1 month.

Please note that personal data of Clients may be disclosed to Couriers and vice versa in connection with legal claims as per the section “Disclosure of personal data for law enforcement and claims” above.

DISCLOSURE OF PERSONAL DATA AS BETWEEN CLIENTS AND RESTAURANTS

The personal data of Clients is disclosed to the Restaurant once the Client has made the Order for a Meal. The Restaurant will see the Client’s first name and first letter of the last name, contact phone number, information about the Order and the Meal ordered, together with any information submitted by the Client together with the Order (for example information about food preference, cooking preferences, information about any allergies if such information is disclosed by the Client in the course of submitting the Order).

Pursuant to data sharing agreement concluded between the Restaurant and Bolt, after providing the delivery service, the Restaurant is entitled to retain the Client data related to the performance of the service for the maximum period of 1 month, unless the applicable law requires the Restaurant to retain the data for a longer period.

Please note that personal data of Clients may be disclosed to Restaurants and vice versa in connection with legal claims as per the section “Disclosure of personal data for law enforcement and claims” above.

DISCLOSURE OF PERSONAL DATA AS BETWEEN COURIERS AND RESTAURANTS

The personal data of Couriers is disclosed to the Restaurant once the delivery agreement between the Client and the Courier is concluded. The Restaurant will see the Courier’s name, contact phone number, and geographic location of the Courier.

Pursuant to data sharing agreement concluded between the Restaurant and Bolt, after providing the delivery service, the Restaurant is entitled to retain the Courier data related to the performance of the service for the maximum period of 1 month, unless the applicable law requires the Restaurant to retain the data for a longer period.

Please note that personal data of Couriers may be disclosed to Restaurants and vice versa in connection with legal claims as per the section “Disclosure of personal data for law enforcement and claims” above.

HOW WE PROTECT YOUR PERSONAL DATA

No data transmission over the Internet or websites can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal data in accordance with applicable data protection legislative requirements.

All personal data you provide to us is stored on our or our subcontractors’ secure servers and accessed and used subject to our security policies and standards. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website or mobile apps, you are responsible for keeping this password confidential and for complying with any other security procedures that we notify you of. We ask you not to share a password with anyone.

INTERNATIONAL TRANSFERS OF PERSONAL DATA

Bolt may disclose personal data to our third party service providers, who may be located in countries outside of the UK or European Economic Area (EEA), subject to contracts with those third parties. These may include:

• our group companies;

• IT or payment services providers. Please note that our payment provider, Adyen, is fully PCI DSS 3.2 compliant as a Level 1 Service Provider;

• age verification service providers, which includes Amazon Web Services Inc (Amazon Rekognition analysis service), Google Cloud (Google Cloud Optical Character Recognition Technology); RuralShores Business Services PVT LTD for conducting human review of the age verification results; and

• data centers provided by, inter alia, Zone Media LTD and/or Amazon Web Services Inc via a service called Zendesk.

When we transfer personal data from inside the UK or EEA to outside the UK or EEA, we will transfer your personal data subject to approved safeguards unless we are permitted under UK/EEA data protection law to make such transfers without such formalities. For further information about the safeguards employed, please contact us at contact details specified below in section “Questions and updates”.

Only authorised employees of Bolt group companies and partners have access to the personal data and they may access the data only for the purpose of resolving issues associated with the use of the services (including disputes regarding transportation services).

YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

You have the right to opt-out of marketing communications at any time. To do so, please click the “Unsubscribe from direct marketing messages” link in the header of our marketing e-mail. You can also opt-out through the Profile section of Bolt mobile App, or by contacting us at contact details specified below in section “Questions and updates”.

Under certain conditions, you may have the right to:

• be provided with details about what personal data we hold about you and to be provided with a copy of your personal data;

• require us to update any inaccuracies in the personal data we hold. In order to assist us with this, please keep your user account/app Profile information in the Bolt App up to date, or contact us at contact details specified below in section “Questions and updates” to inform us of any updates that should be made to your personal data;

• withdraw your consent (where our processing activity is based on your consent);

• be provided with a copy of the personal data you have provided to us in a machine-readable format so that you can transfer it to another provider or ask us to transfer this to another data controller (where our processing activity is based on contract performance or consent);

• require us to delete personal data (including where our processing activity is based on your consent or our legitimate interests). Please note that the uninstallation of the Bolt app in your device does not itself cause the deletion of your personal data;

• restrict how we use your personal data whilst a complaint is being investigated;

• object to our processing of your personal data (where our processing is based on our legitimate interests);

• object at any time to the processing of your personal data which involves automated processing or profiling which has a significant effect on your rights and to require human intervention. You also have the right to require an explanation regarding the logic behind an automated decision we have made. Please see the section titled “Automated Decision Making” above.

Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege).

If you would like to exercise a right, we encourage you to contact our customer support via contact details specified below in section “Questions and updates”. If you exercise any of these rights we will check your entitlement and respond in most cases within a month.

THIRD PARTY LINKS

Our websites and apps may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or their processing of your personal data. Please check these policies before you submit any personal data to such third party websites.

QUESTIONS AND UPDATES

Certain personal data can be viewed and corrected in the Bolt Food app. If you have any disputes, questions or concerns about this privacy policy or your personal data, we encourage you to first contact us:

• by contacting our Customer Support Team in-app when you go to the main menu and tap ‘Support’, the Customer Support Team will then escalate internally to Bolt’s Privacy Legal Team;

• by emailing our Privacy Mailbox at ​privacy@bolt.eu - please mark the subject line of the email ‘For the attention of Bolt’s Data Protection Officer’.

This privacy policy was last updated on 08.04.2024. Any changes we may make to this privacy policy in the future will be posted on this page and, where appropriate, notified by email. Please check back regularly to keep informed of updates or changes to this privacy policy.