Last Updated: September 15, 2026 This Privacy Policy explains how Carna collects, uses, stores, and protects personal data when using the transportation, delivery, and bidding services available on the Platform. By using the Platform, you confirm that you have read and accepted this Privacy Policy. 1. Definitions Carna refers to the company that owns and operates the Platform. Platform refers to the Carna mobile applications, website, and all related systems. User refers to any individual who registers or uses the Platform. Driver, Captain, or Ambassador refers to an independent service provider offering transportation or delivery services through the Platform. Personal Data refers to any information that identifies an individual directly or indirectly. 2. Scope of This Policy This Policy applies to all users and covers account creation, application usage, request processing, bidding between drivers and passengers, payments, identity verification, in-app communication, and device or location permissions. 3. Data Collected Carna may collect personal data provided directly by users, including full name, phone number, email address, profile photo, vehicle information for drivers, identity documents, driving licenses, and KYC documentation. Carna may also collect data automatically, including device information, IP address, usage logs, location data, trip history, bidding activity, and performance data. Transaction-related data may be collected, including trip details, prices, payment methods, and transaction timestamps. 4. Use of Data Personal data is used to provide and operate services, verify identity, facilitate matching and bidding, process payments, enhance safety, prevent fraud, improve Platform performance, and communicate with users regarding service-related matters. Marketing communications are optional and subject to user consent. 5. Data Sharing Personal data may be shared between drivers and passengers as required to complete services. Data may also be shared with third-party service providers, governmental authorities when legally required, or for security and fraud prevention purposes. 6. Data Protection Carna applies technical and organizational measures to protect personal data, including encryption, secure storage, access controls, and server protection. 7. User Rights Users have the right to access and update their personal data, remove profile images, disable location access, opt out of marketing communications, and request account deletion. The Deactivation and account deletion section above explains the request form, verification, timing and completion confirmation for Carna Passenger and Carna Driver. 8. Data Retention Deactivation retains the account and its data; permanent deletion is a separate request. The Deactivation and account deletion section above governs deletion and any remaining legally required retention, including disclosure of the categories, purposes and retention periods or criteria. 9. Updates to This Policy Carna may update this Privacy Policy at any time. Continued use of the Platform constitutes acceptance of the updated Policy.