1. Introduction

Spare Labs Inc. (“Spare”, “we”, “us”, or “our”) respects your privacy and is committed to protecting personal information in accordance with applicable data protection laws, including laws in Canada, the United States, the European Union, the United Kingdom and Japan.

‍

This Privacy Policy describes how Spare collects, uses, discloses, and safeguards personal information when individuals interact with Spare through:

• our websites and online services
• marketing and communications
• recruiting and hiring processes
• customer and business relationships
• support services and communications

‍

This Privacy Policy also explains circumstances in which Spare processes personal information on behalf of transit agencies, municipalities, or other transportation providers that operate mobility services using Spare’s platform.

‍

Spare provides software platforms and related services that enable transportation providers to manage on-demand and scheduled mobility services. When individuals use such services, Spare may process personal information on behalf of the transportation provider as a service provider or processor.

‍

This Privacy Policy explains Spare’s privacy practices when we act as a data controller or business. It also contains important information when Spare processes personal information on behalf of transportation providers.

‍

2. Scope of this Privacy Policy

This Privacy Policy applies to personal information collected by Spare through:

• Spare’s websites and online services
• marketing activities and communications
• conferences, events, and webinars
• recruiting and hiring processes
• customer relationship management activities
• vendor and partner relationships
• technical support and customer service

‍

This Privacy Policy applies to individuals including:

• website visitors
• prospective customers
• customer representatives
• partners and vendors
• job applicants

‍

This Privacy Policy does not replace, or override privacy notices issued by transportation providers that use Spare’s platform to operate mobility services. Those providers may publish their own privacy policies governing how personal information is collected and used within their mobility programs.

‍

3. Notice Regarding Transit Agency Services

Spare provides software platforms and related services to transit agencies, municipalities, universities, and other transportation providers (collectively, “Transportation Providers”). Transportation Providers may use Spare’s platform to operate mobility services, including ride booking, dispatching, scheduling, and related transportation operations.

‍

When individuals use mobility services operated by a Transportation Provider using Spare’s platform:

• the Transportation Provider generally determines the purposes and means of processing personal information;
• the Transportation Provider may act as the data controller or business responsible for the personal information collected through the mobility service; and
• Spare typically processes personal information on behalf of the Transportation Provider as a service provider or data processor.

‍

In these circumstances:

• Spare processes personal information in accordance with contractual agreements with the Transportation Provider;
• the Transportation Provider may determine what personal information is collected, how it is used, and how long it is retained; and
• individuals may need to direct privacy inquiries or rights requests to the Transportation Provider that operates the mobility service.

‍

Even when acting as a processor or service provider, Spare may process personal information for certain limited purposes permitted under applicable laws and contractual obligations, including:

• providing services
• maintaining and improving platform security
• detecting and preventing fraud or misuse
• providing technical support
• ensuring system reliability and performance
• complying with legal obligations

‍

Individuals using mobility services should review the privacy policy of the applicable Transportation Provider to understand how their personal information is handled in connection with the transportation service.

‍

4. Categories of Personal Information We Collect

The categories of personal information Spare collects depend on the nature of the interaction with us.

‍

Website and Marketing Information

When individuals visit Spare’s website or interact with marketing materials, Spare may collect information such as:

• name
• email address
• company name and job title
• telephone number
• professional contact details
• IP address
• browser and device information
• website usage data
• cookies and analytics information

This information helps us operate our website, respond to inquiries, and communicate with potential customers and partners.

‍

Business Contact Information

When individuals interact with Spare in a professional capacity, such as representing a customer, partner, or vendor, we may collect:

• professional contact information
• organization name and role
• business communication records
• meeting notes and correspondence
• account management information

This information is used to manage our business relationships and provide services.

‍

Recruiting and Hiring Information

If you apply for a job with Spare, we may collect information including:

• resumes or CVs
• cover letters
• employment history
• educational background
• references
• interview notes
• background verification information, where permitted by law

This information is used to evaluate job candidates and manage recruitment processes.

‍

Platform Operational Data (Processed on Behalf of Transportation Providers)

When Spare provides platform services to Transportation Providers, the platform may process operational data such as:

• rider account information
• trip requests and trip history
• dispatch and scheduling data
• driver information
• communications between riders and service operators
• customer support interactions

In many cases this information is processed on behalf of Transportation Providers and is governed by agreements between Spare and the provider.

‍

Technical and System Data

Spare may collect technical information related to system usage and platform operations, including:

• server logs
• system performance data
• device identifiers
• network activity
• security monitoring data

This information helps ensure the reliability, performance, and security of our services.

‍

5. How We Use Personal Information

Spare uses personal information for legitimate business purposes consistent with this Privacy Policy.

‍

Website Operation

We use personal information to:

• operate and maintain our website
• improve website functionality
• analyze website traffic and performance

‍

Marketing and Communications

We may use personal information to:

• respond to inquiries
• provide product information
• send marketing communications
• manage event registrations and webinars

Individuals may opt out of marketing communications at any time.

‍

Business Operations

We use personal information to:

• manage customer relationships
• administer contracts and procurement processes
• communicate with partners and vendors
• provide customer support

‍

Recruiting and Hiring

Recruitment information is used to:

• assess job applicants
• communicate with candidates
• conduct hiring processes
• comply with employment obligations

‍

Platform Operations

Where Spare acts as a service provider or processor, we process personal information to:

• operate mobility services
• support dispatch and routing functions
• facilitate communications between riders and operators
• maintain platform performance and reliability

‍

6. How We Share Personal Information

Spare may share personal information with the following categories of recipients.

‍

Service Providers

Spare uses trusted service providers to support our operations, including providers of:

• cloud infrastructure
• analytics services
• communication tools
• hosting and storage services
• customer support systems

These providers process personal information only as necessary to provide services to Spare.

‍

Transportation Providers

Where Spare provides mobility platform services, personal information may be shared with the Transportation Provider operating the service.

‍

Legal and Regulatory Authorities

Spare may disclose personal information when necessary to:

• comply with legal obligations
• respond to lawful requests
• enforce contractual rights
• protect platform security

‍

7. Sub-processors and Infrastructure Providers

Spare may use third-party infrastructure providers and sub-processors to support the delivery of its services. These providers may include companies providing:

• cloud hosting
• system infrastructure
• analytics tools
• communication platforms

Spare requires such providers to maintain appropriate safeguards and to process personal information only in accordance with contractual obligations. The most updated list of the sub-processors can be found here.

‍

8. International Data Transfers

Spare operates internationally and personal information may be processed in countries outside the country where it was originally collected. Where required by applicable law, Spare implements appropriate safeguards to protect personal information, including:

• Standard Contractual Clauses
• contractual data protection commitments
• other lawful data transfer mechanisms

‍

9. Data Retention

Spare retains personal information only for as long as necessary to:

• fulfill the purposes described in this Privacy Policy
• comply with legal obligations
• resolve disputes
• enforce contractual rights

Where, Spare processes personal information on behalf of Transportation Providers, retention periods may be determined by the applicable provider.

‍

10. Data Security

Spare implements administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.

These safeguards may include:

• encryption
• access controls
• system monitoring
• security assessments

Despite these safeguards, no security system is completely secure, and individuals should take appropriate precautions when sharing information online.

‍

11. Cookies and Tracking Technologies

Spare uses cookies and similar technologies to:

• operate the website
• analyze website usage
• improve user experience
• support marketing activities

Users may manage cookie preferences through browser settings or consent mechanisms where required.

‍

12. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information.

These rights may include:

• the right to access personal information
• the right to correct inaccurate information
• the right to request deletion
• the right to restrict processing
• the right to object to certain processing

Where Spare processes personal information on behalf of a Transportation Provider, requests relating to rider data may need to be directed to the applicable provider.

‍

13. Changes to this Privacy Policy

Spare may update this Privacy Policy from time to time. When updates occur, we will update the “Last Updated” date and may provide additional notice where required by law.

‍

14. Contact Information

Questions regarding this Privacy Policy or Spare’s data protection practices may be directed to:

‍

Attn: Chief Privacy Officer

Spare Labs Inc.

Email: legal@spare.com 

Address: 300-601 Hastings St W, Vancouver, BC, Canada V6B 1M8

‍

‍

COUNTRY SPECIFIC SECTIONS

1. Canada Privacy Rights

Individuals located in Canada have rights under Canadian privacy laws including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. Individuals may request access to personal information held by Spare and request corrections where information is inaccurate. Requests may be directed to Spare’s Privacy Officer. Individuals may also file complaints with applicable privacy regulators if they believe their rights have been violated.

‍

2. United States Privacy Rights

Certain U.S. privacy laws grant residents rights relating to their personal information.

These rights may include:

• the right to know what categories of personal information are collected
• the right to request deletion of personal information
• the right to request correction of inaccurate information
• the right to limit certain uses of sensitive personal information

Spare does not sell personal information.

‍

California Privacy Disclosures (CPRA)

This section applies to residents of California and is provided in accordance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The tables below describe the categories of personal information Spare may collect, the sources of that information, and the parties with whom it may be disclosed.

‍

Categories of Personal Information Collected

‍

*Platform operational data is processed on behalf of transportation providers acting as data controllers.

‍

Categories of Sources of Personal Information

Spare may collect personal information from the following categories of sources:

• Individuals interacting with Spare’s website
• Business representatives of customers or partners
• Job applicants and recruitment platforms
• Transportation providers using Spare’s platform
• Riders and service users interacting with mobility programs
• Service providers supporting Spare’s technology infrastructure

‍

Categories of Third Parties with Whom Personal Information May Be Shared

Spare may share personal information with:

• Cloud hosting providers
• Platform infrastructure providers
• Customer relationship management providers
• Analytics providers
• Communications service providers
• Transportation providers operating mobility services

Spare requires such third parties to process personal information only for authorized purposes and subject to contractual safeguards.

‍

Sale or Sharing of Personal Information

Spare does not sell personal information as defined under applicable privacy laws. Spare also does not knowingly share personal information for cross-context behavioral advertising.

‍

Sensitive Personal Information

Spare does not use sensitive personal information for purposes beyond those permitted by applicable law, such as providing services, maintaining security, and complying with legal obligations.

‍

3. European Union and United Kingdom Privacy Rights

Individuals located in the European Union or the United Kingdom may have rights under the General Data Protection Regulation (GDPR) or UK GDPR.

These rights may include:

• the right to access personal data
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object to processing

Individuals also have the right to lodge complaints with their local data protection authority.

‍

4. Japan Privacy Rights

This section applies to individuals located in Japan and is provided in accordance with the Act on the Protection of Personal Information (APPI) and related regulations issued by the Personal Information Protection Commission (PPC).

‍

Spare processes personal information for the purposes described in this Privacy Policy, including:

• operating and maintaining our website
• communicating with customers, partners, and prospective customers
• managing recruiting and hiring processes
• providing platform services to transportation providers
• maintaining platform security and reliability
• complying with legal and regulatory obligations

‍

Where Spare provides platform services to transportation providers operating mobility services in Japan, Spare may process personal information on behalf of those providers in accordance with contractual agreements.

‍

In such cases, the transportation provider may determine the purposes for which personal information is collected and used.

‍

Categories of Personal Information

Personal information collected or processed by Spare may include:

• name and contact details
• professional affiliation and business contact information
• communication records
• website usage information
• device and technical information
• recruiting and employment information
• operational mobility service data processed on behalf of transportation providers

‍

Purposes of Use

Spare uses personal information for the purposes described in this Privacy Policy, including:

• providing and maintaining services
• managing business relationships
• responding to inquiries
• recruiting and hiring
• improving system performance and security

Where personal information is processed on behalf of transportation providers, Spare uses such information only for purposes authorized by the applicable provider.

‍

Provision to Third Parties

Spare may provide personal information to third parties in the circumstances described in this Privacy Policy, including:

• service providers supporting Spare’s infrastructure
• transportation providers operating mobility services
• legal or regulatory authorities where required by law

Spare requires such third parties to implement appropriate safeguards for personal information.

‍

Cross-Border Transfers

Because Spare operates globally, personal information may be transferred to countries outside Japan. Where required by applicable law, Spare implements appropriate safeguards to protect personal information during international transfers, including contractual data protection commitments and other legally recognized mechanisms.

‍

Security Safeguards

Spare implements appropriate administrative, technical, and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction.

These measures may include:

• access controls
• encryption technologies
• monitoring and security audits
• internal privacy and security policies

‍

Rights of Individuals in Japan

Under applicable Japanese law, individuals may have the right to request:

• disclosure of personal information held by Spare
• correction of inaccurate personal information
• deletion of personal information in certain circumstances
• suspension of use of personal information where permitted by law

Requests may be submitted using the contact information provided above.

‍

Where Spare processes personal information on behalf of a transportation provider, requests relating to rider or mobility service data may need to be directed to the applicable provider.

‍

‍

ADDITIONAL DISCLOSURES

1. Rider Data Flow Transparency

Spare’s platform is used by transit agencies, municipalities, and other transportation providers to operate mobility services. To support transparency for riders and regulators, the following section describes how data may flow through the Spare platform.

‍

Rider Data Ecosystem

Mobility services operated using Spare’s platform typically involve several entities:

• Rider or Passenger
• Transportation Provider (Transit Agency/Municipality)
• Spare Platform
• Infrastructure and Technology Providers

In most cases, the Transportation Provider acts as the data controller, while Spare acts as a data processor or service provider.

‍

Rider Data Flow

(Image for Reference Only)

Step 1 – Rider Interaction

A rider interacts with a mobility service through:

• a mobile application
• a web interface
• a call center
• SMS or other communications channels

Information provided may include:

• rider name
• pickup and drop-off locations
• trip preferences
• contact information

‍

Step 2 – Transmission to Platform

The information is transmitted to the Spare platform where it is used to:

• process trip requests
• identify available vehicles
• manage routing and dispatch operations
• communicate service updates

‍

Step 3 – Transportation Provider Operations

The Transportation Provider may access the platform to:

• monitor service performance
• manage vehicles and drivers
• respond to service requests
• provide customer support

‍

Step 4 – Infrastructure Processing

Spare may process data through technology infrastructure providers such as:

• cloud hosting platforms
• system monitoring tools
• communications infrastructure

These providers support the technical operation of the platform but are contractually required to protect personal information.

‍

Data Control Responsibilities

‍

The Transportation Provider determines:

• what data is collected
• how it is used
• how long it is retained
• how rights requests are handled

Spare processes personal information on behalf of the Transportation Provider in accordance with contractual obligations.

‍

Rider Privacy Requests

Individuals using mobility services may have privacy rights depending on their jurisdiction.

Where a Transportation Provider is the data controller, requests such as:

• access requests
• correction requests
• deletion requests

should generally be directed to the Transportation Provider operating the service. Spare will assist Transportation Providers in fulfilling such requests where required by contractual obligations and applicable law.

‍

Operational Transparency

Spare designs its platform to support:

• secure data handling
• operational transparency
• auditability for transportation providers
• compliance with applicable data protection laws

Transportation Providers may configure the platform according to their privacy obligations and program requirements.

‍

2. Location Data and Trip Data

Spare’s platform enables transportation providers to operate mobility services that may involve the processing of location and trip-related data, because geolocation information may be considered sensitive or high-impact personal data under certain privacy laws, Spare provides additional transparency regarding how such information may be processed.

‍

Types of Location and Trip Data

Mobility services operated using Spare’s platform may involve the processing of information including:

• pickup and drop-off locations
• rider trip requests
• trip routes and destinations
• vehicle locations during trips
• estimated arrival times
• trip duration and distance
• trip status and service updates
• location data associated with service operations

‍

This information may be generated through:

• mobile applications
• web interfaces
• dispatching systems
• vehicle telematics systems
• communication tools used by drivers or service operators

‍

Location information may be derived from technologies such as:

• GPS signals
• device location services
• network-based location estimates
• dispatch and routing systems

‍

Purposes for Processing Location and Trip Data

Location and trip data may be processed to support mobility services, including to:

• match riders with available vehicles
• determine pickup and drop-off locations
• calculate routes and estimated travel times
• facilitate dispatch and scheduling operations
• provide trip status updates
• improve transportation service efficiency
• monitor service performance and reliability
• support customer assistance and issue resolution

When a trip is active or a driver is approaching a pickup location, a rider’s real-time location may be shared with the assigned driver or service operator to help facilitate pickup and coordination. Location and trip data may also be used in aggregated or de-identified form for operational analysis and service improvement.

‍

Processing on Behalf of Transportation Providers

In many deployments of Spare’s platform, location and trip data are processed on behalf of a transportation provider, which determines the purposes and means of processing. In such cases:

• the transportation provider acts as the data controller or business
• Spare acts as a data processor or service provider
• Spare processes location and trip data in accordance with the transportation provider’s instructions

‍

Transportation providers may determine:

• what location information is collected
• how long trip data is retained
• how location data is used for operational purposes
• how individuals may exercise their privacy rights

Individuals using mobility services should consult the privacy policy of the applicable transportation provider for additional information.

‍

Sharing of Location and Trip Data

Location and trip data may be shared with:

• the transportation provider operating the service
• drivers or service operators responsible for providing the ride
• authorized customer support personnel
• technology infrastructure providers supporting the platform

Spare does not sell location or trip data.

‍

Retention of Location and Trip Data

Retention of location and trip data may depend on the policies of the transportation provider operating the mobility service.

Spare may retain certain operational records for limited periods where necessary to:

• maintain platform functionality
• investigate service issues
• comply with legal obligations
• maintain security and fraud prevention systems

Where Spare processes data on behalf of transportation providers, retention may be determined by contractual agreements with those providers.

‍

Safeguards for Location Data

As location information can reveal sensitive details about individuals’ movements, Spare implements safeguards designed to protect such information. These safeguards may include:

• access controls limiting who can view location data
• encryption of data during transmission and storage
• system monitoring and logging
• security audits and vulnerability management

‍

User Controls and Device Settings

Users of mobility applications may be able to manage location sharing through:

• device location settings
• application permissions
• privacy settings within the application

Disabling location services may affect the functionality of mobility services that rely on location information to operate.

‍

3. Children’s Privacy

Spare’s services are primarily designed for use by transportation providers, business customers, and adult riders using mobility services operated by those providers. Spare does not knowingly collect personal information directly from children under the age required by applicable law without appropriate authorization. If a mobility service operated by a transportation provider permits use by individuals under the age of 16 (or another age threshold required by applicable law), the transportation provider is responsible for determining the lawful basis for collecting and processing such information, including obtaining any necessary parental or guardian consent where required.

‍

In these circumstances:

• the transportation provider generally acts as the data controller or business; and
• Spare processes personal information on behalf of the transportation provider as a data processor or service provider.

‍

Transportation providers may implement additional safeguards for child users, including:

• parental consent requirements
• eligibility verification processes
• restricted account functionality
• enhanced privacy protections

‍

If Spare becomes aware that personal information has been collected directly from a child in violation of applicable law, Spare will take reasonable steps to delete such information or ensure it is processed only in accordance with applicable legal requirements. Parents or guardians who believe that a child has provided personal information improperly may contact Spare using the contact details provided in this Privacy Policy.

‍

4. Automated Decision-Making and Dispatching

Spare’s platform may incorporate automated systems designed to support transportation operations. These systems may assist transportation providers in performing functions such as:

• trip matching between riders and vehicles
• routing and dispatch optimization
• scheduling of rides
• estimation of travel times
• capacity and fleet management

‍

These processes may rely on algorithms that analyze operational data such as:

• trip requests
• vehicle locations
• traffic conditions
• service availability
• historical service patterns

‍

Automated systems are used to support operational efficiency and improve service reliability for transportation providers and riders.

‍

Spare’s platform is designed to support human oversight by transportation providers. Transportation providers and their staff may monitor dispatch operations, adjust routing decisions, and intervene in service management where appropriate.

‍

Spare does not use automated decision-making systems to make decisions that produce legal or similarly significant effects on individuals without appropriate safeguards where required by applicable law.

‍

Where required by applicable law, individuals may have the right to request information regarding automated processing or request human review of certain decisions.

‍

5. Accessibility Program Data

Some transportation providers operate mobility services that include accessibility programs or specialized transportation services for individuals with disabilities, seniors, or other eligible populations.

Participation in such programs may require the collection or processing of certain eligibility or accommodation information.

‍

Examples of accessibility-related information may include:

• eligibility status for paratransit or specialized services
• mobility assistance requirements
• accessibility preferences for vehicles or services
• program enrollment information

‍

This type of information may be considered sensitive personal information under certain privacy laws.

‍

Controller Responsibilities

The transportation provider operating the accessibility program acts as the data controller or business responsible for determining:

• what accessibility information is collected
• how eligibility is determined
• how the information is used
• how long it is retained

‍

Spare processes such information only on behalf of the transportation provider and in accordance with contractual instructions.

‍

Safeguards for Accessibility Data

Spare implements safeguards designed to protect accessibility-related information, including:

• restricted access controls
• system monitoring and logging
• encryption where appropriate
• internal privacy and security policies

‍

Transportation providers may also implement their own policies and procedures governing the collection and use of accessibility program data. Individuals participating in accessibility programs should consult the privacy notice of the applicable transportation provider for additional details.

‍

6. Call Recording Notices

Spare and Transportation Providers using Spare’s platform may offer customer support through channels such as:

• call centers
• telephone-based ride booking
• customer service lines

‍

In certain cases, telephone calls may be recorded or monitored for purposes including:

• quality assurance
• training and service improvement
• dispute resolution
• compliance with legal obligations
• investigation of service issues

‍

Where call recording is used, callers may be notified through automated messages or other appropriate notices prior to recording.

‍

Processing of Call Data

Recorded calls may include personal information such as:

• contact information provided during the call
• service requests
• trip-related information
• support inquiries

‍

Call recordings may be processed by Spare or by Transportation Providers operating the service.

‍

Where Spare processes call recordings on behalf of a Transportation Provider, Spare acts as a data processor or service provider, and the transportation provider determines the purposes for which recordings are collected and used.

‍

Retention of Call Recordings

Call recordings may be retained for limited periods necessary to:

• resolve service issues
• maintain customer support records
• comply with regulatory requirements

Retention periods may vary depending on the policies of the Transportation Provider operating the service.

‍

‍

DATA RETENTION SCHEDULE

Spare retains personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce contractual rights, and maintain system security. Retention periods may vary depending on the nature of the data, the services provided, and contractual obligations with transportation providers. Where Spare processes personal information on behalf of a Transportation Provider, the Transportation Provider may determine applicable retention periods. The following table provides typical retention periods for key categories of personal information processed by Spare.

‍

Processor-Specific Retention

Where Spare processes personal information on behalf of Transportation Provider, retention may be determined by the Transportation Provider in accordance with their legal obligations and program policies. In such cases:

• Spare retains data only for the duration necessary to provide services or as directed by the Transportation Provider; and
• Spare deletes or returns personal information upon termination of the applicable service agreement, unless retention is required by law.

‍

De-Identified and Aggregated Data

Spare may retain de-identified or aggregated information derived from operational datasets for longer periods where such data:

• no longer identifies individuals; and
• is used solely for analytics, service improvement, or system performance monitoring.

‍

Deletion and Anonymization Practices

Spare implements procedures designed to ensure personal information is deleted, anonymized, or securely archived when it is no longer required for the purposes for which it was collected. Deletion practices may include:

• automated data lifecycle policies
• anonymization of historical datasets
• periodic review of stored records

‍

Data Governance and Accountability Framework

Spare maintains a comprehensive data governance and accountability framework designed to ensure that personal information is handled responsibly, securely, and in compliance with applicable privacy laws. This framework supports Spare’s obligations to Transportation Provider, riders, business partners, and regulators and reflects Spare’s commitment to transparency, security, and responsible data management.

‍

Privacy Governance

Spare maintains internal governance structures and policies designed to oversee the responsible processing of personal information. These governance measures include:

• designation of a Privacy Officer or Data Protection Lead responsible for privacy oversight
• internal privacy and data protection policies governing the collection, use, and protection of personal information
• data protection reviews conducted when introducing new features or services that involve personal data
• processes for responding to privacy inquiries, complaints, and requests from individuals
• procedures for managing data incidents and security events

Spare regularly reviews its privacy practices to ensure they remain aligned with evolving regulatory requirements and industry standards.

‍

Security and Compliance Certifications

Spare implements security controls designed to protect personal information and maintain the integrity and availability of its platform. These controls may include:

• encryption of data during transmission and storage
• access control mechanisms restricting access to authorized personnel
• monitoring and logging of system activity
• vulnerability management and security testing
• incident response procedures

‍

Spare maintains following security and compliance frameworks:

• SOC 2 Type 2 (Service Organization Control) certifications
• ISO 27002 information security standards

Details regarding Spare’s security practices may be made available under appropriate confidentiality obligations.

‍

Audit Rights for Transportation Providers

Transportation Provider using Spare’s platform may have contractual rights to verify Spare’s compliance with security and data protection obligations. These rights may include:

• review of security documentation and certifications
• review of third-party audit reports
• participation in security or compliance reviews
• confirmation of Spare’s data protection practices through customer due diligence processes

Where appropriate, Spare may provide documentation demonstrating its compliance with applicable data protection laws and security obligations, subject to reasonable confidentiality and security safeguards.

‍

Internal Privacy Training and Awareness

Spare provides internal training and guidance to employees regarding privacy and data protection responsibilities. These programs may include:

• privacy and security awareness training
• guidance on handling personal information securely
• training on incident response and reporting procedures
• internal policies governing acceptable data use and access controls

Employees and contractors who have access to personal information are expected to comply with Spare’s privacy and security policies.

‍

Data Protection Incident Response

Spare maintains procedures designed to identify, respond to, and mitigate potential data security incidents. These procedures may include:

• internal incident response protocols
• investigation and containment processes
• notification procedures where required by law or contractual obligations
• coordination with transportation providers where incidents involve mobility service data

Spare seeks to respond promptly to potential incidents and implement measures designed to prevent recurrence.

‍

Commitment to Responsible Data Practices

Spare’s governance framework is designed to support responsible data stewardship across all aspects of its platform and services. This framework helps ensure that personal information processed through Spare’s systems is handled in a manner that supports:

• regulatory compliance
• operational transparency
• trust with transportation providers and riders
• ongoing security and privacy protection