Version: (please insert here effective date)

Privacy Policy (Website)

Ride Hive sp z.o.o. (hereinafter "HIVE". “we”, “us” or “our”), is an urban mobility solution that enables users to locate, activate, and operate electric scooters within predetermined areas (“Services”).

Data protection and data security, as well as its transparency are very important to us. Therefore, this Privacy Policy explains which data we collect from you, for what purposes we may use it, how we process it, when we might disclose it, for how long we keep it, as well as the ways for you to manage your personal data and exercise your rights.

As changes to the law or changes to our corporate processes may require an adaptation of the following privacy statement, we ask you to read this privacy policy regularly. The privacy policy can be accessed at any

time under “Privacy Policy (Website)” in the footer of our website, can be saved and printed out.

Please note: In case you want to be informed about, how we process your personal data in terms of the use of our HIVE E-Scooter Services through our HIVE App, please refer to the privacy policy within the HIVE App or click here.

§1 Data Controller and Scope

The controller in the sense of the EU General Data Protection Regulation (hereinafter: GDPR) is:

Ride Hive sp z.o.o.

ul. Otwocka 14, 03759

Warsaw, Poland

E-mail: help@ridehive.com

Website: www.ridehive.com

This privacy policy applies to the online presence of HIVE (and any versions optimized for viewing on a wireless or tablet device), which is available at www.ridehive.com (hereinafter referred to as "our website"); when you contact us; or when receiving and viewing the email newsletters that we publish or distribute.

For more information on how we process your personal data in terms of the use of our HIVE E-Scooter Services through our HIVE App, please refer to the privacy policy within the HIVE App or click here.

§2 Data Protection Officer

Our external Data Protection Officer is:

Attorney at Law Dr. Karsten Kinast, LL.M
KINAST Rechtsanwaltsgesellschaft mbH
Hohenzollernring 54
50672 Cologne, Germany

E-Mail: dpo-hive@kinast.eu
Website: www.kinast.eu

§3 Principles of Processing Personal Data

Personal data are all information relating to an identified or identifiable natural person. This includes information such as your name, age, address, telephone number, date of birth, e-mail address, IP address or user behavior. Information that cannot (or only with a disproportionate effort) be referred to your person, e.g. by anonymizing the information, is not personal data. The processing of personal data (e.g. the collection, retrieval, use, storage or transmission) always requires a legal basis or your consent.

Processed personal data will be deleted as soon as the purpose of the processing has been fulfilled and no legally prescribed retention obligations are to be observed.

In case we process your personal data for the provision of certain offers, please find below information about the specific processes, the scope and purpose of data processing, the legal basis for processing and the respective storage period.

In case of automatically collected data, e.g. device information about your computer, browser, traffic data, etc., you will not be subject to automated decision-making, including profiling.

This Privacy Policy contains both information about our data processing activities concerning data collected directly from you (according to Art 13 GDPR) as well as information about our data processing activities concerning data that has not been obtained directly from you (according to Art 14 GDPR).

§4 Data Processing

1. Provision of the Website

a. Scope and Purpose of the Processing

When you access and use our website, we only collect the personal data that your browser automatically transmits to our server. This information is temporarily stored in a so-called log file.

The following personal data is collected to the extent necessary for the provision of a functional website and our contents and services:

• IP address of the requesting computer

• Date and time of access

• Name and URL of the retrieved file

• The website from which access is made (referrer URL)

• The used browser and, if applicable, the operating system of your computer as well as the name of your access provider

• Geolocation data (e.g. Current Location through GPS, IP Address, or Cell Tower)

b. Legal Basis

The processing of the aforementioned data (cf. § 4 1. a.) is necessary for the provision of our services and thus serves a legitimate interest according to Art. 6 para. 1 lit. f GDPR.

c. Data Deletion and Storage Period

The data subject’s personal data are deleted or blocked as soon as the purpose of the processing is fulfilled. The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection for the user. Further storage may take place in individual cases if this is required by law.

2. Contact Us

I. Contact form

a. Scope and Purpose of Processing

You have the opportunity to contact us using a form provided on our website. If you use the contact form, the following personal data will be processed:

• E-mail address

• Name

• Information you voluntarily provide to us in your contact message.

The purpose of entering your e-mail address is to assign your request and to be able to reply to you. You may choose to provide us with this information or decline to do so. However, without these details, we may not be able to fulfill your request.

b. Legal Basis

The processing of the personal data described above (cf. § 4 2. I. a.) for the purpose of establishing contact with us is carried out voluntarily in accordance with Art. 6 para. 1 lit. a GDPR, since you have freely given your consent.

c. Storage Period

As soon as your request has been completed and the relevant facts have been finally clarified, your personal data processed within the course of our communication will be deleted. Further storage may take place in particular cases, if this is required by law.

II. Contact via E-Mail Request

a. Scope and Purpose of Processing

If you send us an e-mail to one of our various e-mail addresses, requesting information about our company, products or technical issues and submit your request, the only processed data category is your e-mail address and the personal data you provide in our correspondence with you including, if necessary:

• Name

• E-Mail Address

• Information you voluntarily provide to us in your E-mail request

Please be sure that we will ask for your consent before using personal information for other purposes than complying with your e-mail request.

b. Legal Basis

The legal basis for the above referenced data (cf. § 4 2. II. a.) is Art. 6 para. 1 lit. f GDPR, since there is both an interest in establishing contact and communication between you and our company as well as a justified company interest in processing these data in order to be able to process your request.

c. Storage Period

The period of time for which the abovementioned data will be stored depends on the purpose for you having made contact. Your data will be routinely erased once the purpose behind the communications has lapsed and storage is no longer necessary (e.g. once your enquiry/message has been dealt with/responded to). Further storage may take place in individual cases if this is required by law.

3. Use of HIVE electric scooters through the FREE NOW Passenger App

a. Scope and Purpose of Processing

Beside our HIVE App, you also have the chance to make use of our Services by using the FREE NOW Passenger App.

If you decide to use our Services including customer services that are related to the HIVE Services, such as answering of customer inquiries and complaints via the FREE NOW Passenger APP, we will process your personal data together with FREE NOW as so-called joint controllers according to Article 26 GDPR.

Data Processing as Joint Controllers:

Due to the data processing as joint controllers, in case of using our Services through the FREE NOW Passenger App, your personal data will be processed by both FREE NOW and HIVE.

FREE NOW and HIVE will process the following personal data:

Without the aforementioned processing of personal data, the services cannot be provided to you through the Free Now Passenger APP.

b. Legal Basis

The data processing is needed for the performance of the rental contract as well as the customer service, including the answering of customer inquiries and complaints in relation to the HIVE services (Article 6 (1) b) GDPR).

c. Storage Period

We will store your personal data only for as long as required to fulfil the contractual obligations towards you including your requests to the customer service. Further storage may take place if this is required by law.

For more information on the processing of FREE NOW, please refer to their Privacy Policy, which is available at free-now.com and is subject to the responsibility of FREE NOW.

4. Fraud Prevention

a. Scope and Purpose of the Processing

We also occasionally monitor correct usage of our Services via the Hive App in order to detect fraudulent activities (e.g. if you would register for more than one user account in order to make use of the special credits). Protecting Hive regarding fraud and fraudulent activities is a legitimate interest that we pursue.

For the purpose of fraud prevention, we process the following personal data:

• Serial number

• MAC address

• device IDs

• or other unique identifiers’

b. Legal Basis

Art. 6 para. 1 lit. f GDPR serves as the legal basis, as the processing of your personal data (cf. § 4 6. a.) is required to pursue our legitimate interests.

c. Storage Period

We will store your personal data for the duration of being a user of Hive and until the user requests the deletion of their data or as soon as the processed data are no longer necessary to comply with contractual or legal obligations after. Further storage may be necessary in particular cases if this is required by law.

§5 Disclosure to Third Parties

We only share your personal information with third parties if:

• you have given your express consent pursuant to Art. 6 para. 1 lit. a GDPR,

• it is legally permissible and necessary for the fulfilment of a contractual relationship with you pursuant to Art. 6 para. 1 lit. b GDPR,

• there is a legal obligation to pass on the data in accordance with Art. 6 para. 1 lit. c GDPR,

• the disclosure pursuant to Art. 6 para.1 lit. f GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data.

We may share your personal data with affiliated and non-affiliated organizations as follows:

§6 Third Country Transfers

The storage as well as the processing of your personal data as described above may require that your personal data are ultimately transferred to, and/or stored at, a destination outside of your country of residence, including countries outside the European Economic Area (“EEA”), whose legislation on the protection of personal data differs from that of the European Union, for the purposes of internal management services as well as of commercial communication and promotional operations.

In the event that the recipient country does not ensure a level of data protection equivalent to that of the European Union, we undertake to take all appropriate guarantees, either on the basis of an adequacy decision, in particular with US Privacy Shield certified companies, or, in the absence of such a decision, on the basis of appropriate guarantees, such as binding corporate rules, standard contractual clauses adopted by the European Commission, a code of conduct or a certification mechanism duly approved by the competent authority. A copy of the appropriate and suitable safeguards for those international data transfers, which can be obtained by sending an e-mail to the following address: help@ridehive.com.

§7 Cookies

We use Cookies on our website. Cookies are small files which are sent by us to the browser of your terminal device and stored there as part of your visit to our internet pages. Some functions of our website cannot be offered without the use of technically necessary Cookies. Other Cookies allow us to perform various analyses. Cookies are, for example, able to recognize the browser you are using when you visit our website again and to transmit various information to us. We can use Cookies to make our internet offer more user-friendly and effective, for example, by tracking your use of our website and by determining your preferred settings (e.g. country and language settings). In case third parties use Cookies to process information, they will collect the information directly from your browser. Cookies do not cause any damage to your device. They cannot run programs or contain viruses.

Before we set any, not technically necessary, Cookies on our website, we obtain your consent via the Cookie Banner respectively the Cookie Settings in accordance with Article 6 para. lit. a GDPR. You can of course change your preferences at any time in the Cookie Settings.

Further information can be obtained from our Cookie Policy at ridehive.com.

§8 Tools for Tracking and Analysis

We use tracking and analysis tools to ensure continuous optimization and user-oriented design of our website. With the help of tracking measures it is also possible for us to statistically record the use of our website by visitors and to further develop our online offer for you with the help of the knowledge gained.

If you have given us your consent to the use of Cookies on the basis of the Cookie Banner provided by us on the website, the legality of the use is governed by Article 6 para. 1 lit. a GDPR.

Further information can be obtained from our Cookie Policy at ridehive.com.

§9 Plug-Ins

Our websites contain social plugins of the social networks „Instagram“ and „Facebook“. You recognize the respective plugin by the corresponding logo of the provider.

1. Instagram

a. Scope and Purpose of Processing

Our website contains a button of the social network “Instagram”. When you press this button, your browser connects to Instagram Inc.'s servers (hereinafter “Instagram“). Using the data transmitted to Instagram via the plugins, Instagram can assign you to your account. The processing of the user’s personal data takes place for the purpose of managing our marketing activities. For further information we refer to the Cookie Policy at ridehive.com.

The latest data protection information on the "Instagram Button" and additional information can be found on this website: https://help.instagram.com/519522125107875

b. Legal Basis

The processing of users' personal data takes place if you have given your express consent in pursuant to Article 6 para. 1 lit. a GDPR.

c. Data Deletion and Storage Time

Once the data have been transmitted to Instagram and are no longer necessary for the aforementioned purpose, the information will be deleted. Further storage may take place in particular cases if required by law.

For further information regarding the scope and purpose of the data collection by Instagram as joint controller, as well as further processing and use of your personal data, please refer to the Privacy Policies at the website of Instagram. There, you can also receive further information about your corresponding rights as a data subject and setup options to protect your privacy.

2. Facebook

a. Scope and Purpose of Processing

Our website contains a button of the social network “facebook”. When you press this button, your browser connects to Facebook Inc.'s servers (hereinafter “facebook“). Using the data transmitted to facebook via the plugins, facebook can assign you to your account. The processing of the user’s personal data takes place for the purpose of managing our marketing activities. For further information we refer to the Cookie Policy at ridehive.com.

The latest data protection information on the "facebook Share Button" and additional information can be found on this website: https://www.facebook.com/policy.php and https://www.facebook.com/help/186325668085084

b. Legal Basis

The processing of users' personal data takes place if you have given your express consent in pursuant to Article 6 para. 1 lit. a GDPR.

c. Data Deletion and Storage Time

Once the data have been transmitted to facebook and are no longer necessary for the aforementioned purpose, the information will be deleted. Further storage may take place in particular cases if required by law.

For further information regarding the scope and purpose of the data collection by facebook as joint controller, as well as further processing and use of your personal data, please refer to the Privacy Policies at the website of facebook. There, you can also receive further information about your corresponding rights as a data subject and setup options to protect your privacy.

§10 Hyperlinks

Our website contains hyperlinks to websites of other providers. When you activate these hyperlinks, you will be directed directly to the other providers' website. You will recognize this when the URL is changed. Please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

§11 Your Rights as a Data Subject

If your personal data are processed, you are a data subject within the meaning of the General Data Protection Regulation (GDPR) and the following rights apply to you:

• Pursuant to Art. 15 GDPR you can request information about your personal data processed by us. In particular, you may obtain information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the right to lodge a complaint with a supervisory authority, the origin of your data, if not collected from us, about transfer to third countries or international organisations, and the existence of automated decision-making, including profiling and, where applicable, meaningful information about the logic involved.

• Pursuant to Art. 16 GDPR you can immediately demand the correction of incorrect data or the completion of your personal data stored with us.

• Pursuant to Art. 17 GDPR, you may request the deletion of your personal data stored by us, provided that the processing is not necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.

• Pursuant to Art. 18 GDPR, you can request the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful, if we no longer need the data and if you refuse their deletion because you need to establish, exercise or defend legal claims. You are also entitled to the right under Art. 18 GDPR if you have objected to the processing in accordance with Art. 21 GDPR.

• Pursuant to Art. 20 GDPR, you may request that the personal data you have provided us with be received in a structured, current and machine-readable format or you may request that it be transmitted to another person responsible.

• Pursuant to Art. 7 para. 3 GDPR you can withdraw your consent at any time. As a consequence, we are no longer allowed to continue the data processing based on this consent for the future.

• Pursuant to Art. 77 GDPR, you have the right to complain to a supervisory authority. You can contact the supervisory authority of your habitual residence, place of work or our company headquarters (ul. Otwocka 14, 03759 Warsaw, Poland).

You can exercise these rights by contacting HIVE at help@ridehive.com or by filling out and sending us the contact form that can be found on our website.

§12 Right to Object

In case the processing of your personal data is based on legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR insofar as there are reasons which arise from your particular situation or if the objection refers to direct marketing. In the case of direct marketing, you have a general right to objection which will be considered without mentioning any particular situation.

§13 Data Security and Security Measures

We are committed to protecting your privacy and treating your personal information confidentially. In order to avoid any manipulation, loss or misuse of your data stored by us, we take extensive technical and organisational security measures that are regularly reviewed and adapted to technological progress. This includes, among other things, the use of recognized encryption methods (SSL or TLS).

However, we would like to point out that due to the structure of the internet, it is possible that the rules of data protection and the above mentioned security measures may not be observed by other persons or institutions for which we are not responsible.

In particular, unencrypted data - e.g. if this is done by e-mail - can be read by third parties. We have no technical influence on this. It is the responsibility of the user to protect the data provided by him against misuse by encryption or in any other way.