Privacy Policy

Updated December 19, 2024

1. INTRODUCTION

Curbngo USA, LLC owner of the Platform which consists of all of its products and services, including but not limited to, Curbngo.com, Curbngo apps, Curbngo software, and Curbngo kiosks (“Company” or “We” or “Platform”) is committed to protecting your privacy through this privacy policy (“Policy”). This Policy describes the kinds of information we may collect or that customers, merchants, third-party business partners, drivers or their Personnel or anyone else using or viewing our Platform (“you”) may provide when you use the Company services through any medium listed above, whether in writing or orally, and whether on your PC, laptop, or mobile device, including payment processing, gift card services, (“Platform” or as further defined in our Terms) and our overall program for safeguarding, storing, processing, and sharing said data. If you oppose our policies and practices, you may not use the Platform. By accessing or using this Platform, you agree to this Policy and our Terms and Conditions. We may modify the Policy from time to time, in our sole discretion, and we shall notify you by posting such changes here. Please check the Platform regularly, as, to the extent permitted by law, continued use of the Platform following the changes, will be deemed as acceptance of such changes.

2. WHERE WE COLLECT

• 2.a. This policy applies to personal information (“PI”) we collect:
  • 2.a.i. from this Platform (customer or Merchant-facing) or accounts created through such;
  • 2.a.ii. in electronic messages between you and this Platform;
  • 2.a.iii. when you engage with our advertising on third-party platforms should those advertisements link to this Platform;
  • 2.a.iv. our point-of-sale (POS) services;
  • 2.a.v. when you send messages to your driver;
  • 2.a.vi. via joint marketing partners;
  • 2.a.vii. from social media companies; and
  • 2.a.viii. From other service providers.
• 2.b. This Policy does not apply to information collected: Offline or via any other means such as publicly available or social media data which we may use in reference to your account.

3. MINORS

Our Platform is not aimed at minors under 18 years of age. Minors may not provide any PI to the Platform unless they have provided prior express written consent from an adult with authority to do so. We never intentionally collect PI from minor. If you are a minor, do not use this Platform or provide us with any PI, register for or purchase from the Platform. If we learn we have PI from a child, we will delete it. If you believe we have PI belonging to minors, please contact us at legal@curbngo.com.

4. PI WE COLLECT

The number of types of PI we collect, typically correspond to the depth of the relationship between us and you. We collect types of PI from and about our users, directly and indirectly:

• 4.a. Data Forms:
• 4.a.i. Categories of PI: In the preceding 12 months, with consent we have collected, the following categories of PI:
  • 4.a.i.1. Identifiers: this includes name, address, telephone number, email address, delivery address, billing address, device type, preferences, IP address, license plate (if using curbside pickup) and your Curbngo username and password.
  • 4.a.i.2. Customer Records.
  • 4.a.i.3. Biometric Data.
  • 4.a.i.4. Protected Classification: Gender Type and Age
  • 4.a.i.5. Sensory: Audio or Visual Information
  • 4.a.i.6. Employment Information
  • 4.a.i.7. Commercial Purchasing Information: this includes financial details, products purchased or considered and rewards program participation. We use this information to process your transactions and prevent fraud. Payment information is retained as long as your account is active and as needed to comply with legal obligations.
• 4.a.ii. Data Collected Automatically: Whether on an individual or aggregated basis, such as:
  • 4.a.ii.1. Internet, Website Usage or Network Activity: such as device related data, ad data, logs, other communications data and resources you access on the Platform, page views statistics, clicks and web traffic.
    • 4.a.ii.1.a. Log Data: This includes details of your Platform use such as your originating URL, which browser or search terms you used on the Platform.
  • 4.a.ii.2. Geolocation: via location services on your mobile device. We may collect near field communication protocols (“precise location information”), you can disable this on your mobile device.
  • 4.a.ii.3. Inferences Used to Profile: Such as behavior, preferences, and characteristics.
  • 4.a.ii.4. Device and connection data: such IP address, OS, settings, browser type over time and across third-party Platforms and other online services. If you choose to disable the location feature, our driver will not have your precise location, which may compromise the reliability of deliveries, such as if you are in large open area or the referring domain with the online content you have viewed or actions on other sites.
• 4.a.iii. Data from Other Sources: we may also collect PI from other parties such as identity verification, our business partners, and credit card companies.

5. AUTOMATIC COLLECTION TECHNOLOGIES

Automatic data collection technologies may include:

• 5.a. Cookies: Cookie is a small file placed on the hard drive of your device. You may refuse to accept browser cookies via your browser settings. However, if you select such you may be unable to access certain parts of our Platform. Our system will issue cookies when you direct your browser to our Platform. It may be used to remember things such as what was in your shopping cart.
• 5.b. Flash Cookies: Some of the Platform may use local stored objects (or Flash cookies) to collect and store data about preferences and navigation to, from, and on our Platform. Flash cookies are not managed by same browser settings as browser cookies.
• 5.c. Web Beacons: The Platform may contain small electronic files known as web beacons (a.k.a. clear or single-pixel gifs and pixel tags) that permit us to count users who visited pages and other Platform statistics (i.e., popularity of content, verifying system integrity).

6. CONTROL OF YOUR COOKIES

There are ways to control tracking technologies within your browser's settings. Consult “help” menu in your browser. See allaboutcookies.org for more details. Depending on services, restricting cookies may prevent full use of Platform.

How We Collect: We collect this information:

• 6.a. Directly from you (which may be used for profiling), by submitting PI on the Platform, you agree to our data processing, such as by:
  • 6.a.i. completing forms, requesting further services or other correspondence on our Platform,
  • 6.a.ii. subscribing to our service,
  • 6.a.iii. from transactions including financial data.
• 6.b. Social Media. If available, you can sign-in with platforms such as Facebook to verify your identity and you may share certain PI with us via the Platform. We may use plugins (e.g., the “Like” or “Share to LinkedIn” button) so you may easily interact with certain social media platforms and share information. When you visit our Platform, those platforms can place a cookie on your device to recognize recurring visitors. The plugins also allow those platforms to receive data from us. We may interact with you on such platforms if you contact us there, request services, or otherwise communicate directly with us.
• 6.c. Referrals: By sending a referral, you consent to sending your stored data to the connection. When you provide us with your friend's details, it is you who is affirming you are authorized to do so, and we shall never be liable for such. When someone else provides us with your data as part of a referral, we more store their data as we imply such consent from their provision of the PI.

7. WITH WHOM WE SHARE DATA

We share:

• 7.a. With our business partners;
• 7.b. with third parties to provide, maintain and improve and expand our Services; to perform services on our behalf, such as hosting and information technology; or
• 7.c. in connection with, or during the negotiation of, any corporate action.

8. HOW WE USE DATA

We store all PI in the United States and said data is subject to those relevant laws. We use data that we collect, or you provide, including any PI to

• 8.a. Present our Platform to you including identity verification and identifying Platform-related concerns
• 8.b. Provide you with information on products, or services that you request from us or notify you in relation to a purchase including sending you digital receipts.
• 8.c. Update, offer support and train pertaining to the Platform
• 8.d. Fulfill any other purpose for which you provide such PI or any purpose with consent.
• 8.e. Process payments and transactions.
• 8.f. Perform our duties and enforce our rights from agreements between you and us.
• 8.g. Notify you of changes to our Platform, products, or services we offer or other direct marketing.
• 8.h. In any other way we may describe when you provide PI.
• 8.i. Research and analytics.
• 8.j. Marketing: communicating, directly or indirectly, regarding new offerings you may enjoy; and enabling our Merchants, to market or sell to you. You can opt out or unsubscribe from any marketing communications by following instructions or by contacting us. Opting out of a communication will not necessarily opt out of all communications, you may still receive certain non-marketing messages after opting out.
• 8.k. Product development and to generally improve efficacy of our offerings.
• 8.l. Internal uses: evaluating performance and effectiveness and staff development.
• 8.m. IT management, monitoring and data security including fraud detection and auditing.
• 8.n. Protect our privacy, safety, rights or property (in litigation where PI is related, we may use or share without consent or court process) and allow us to pursue remedies to limit damages.
• 8.o. Enforce or apply our terms of use and agreements, such as billing and collection.
• 8.p. Legal Compliance: We may disclose PI if required or permitted by law such as for measures to safeguard your rights, freedoms, and legitimate interests, or in the good faith belief that such is necessary to:
  • 8.p.i. comply with a subpoena or similar legal obligation; or
  • 8.p.ii. act in urgent situation to protect the safety of users of the Platform or the public.

9. DATA RECIPIENTS

We may disclose PI we have about you, as described herein, to:

• 9.a. our subsidiaries, business partners, third parties and affiliates for business operations.
• 9.b. a buyer or other successor in the event of a corporate action.
• 9.c. third parties: providers of technology, drivers, human resources, auditors, professional advisors, or direct marketers.

10. DATA SECURITY

The security of your data is important to us but remember no method of transmission or storage is 100% secure we cannot guarantee the absolute security of any data.

• 10.a. Security Program: We implemented administrative, technical, and physical measures to secure your PI from accidental loss and unauthorized access, use, and disclosure.
• 10.b. Payments: Any payments will be encrypted and under no circumstances will we use your unencrypted cardholder data without a reasonable commercial purpose.
• 10.c. Your Duties: Security of your data also depends on you. You must keep your login credentials secure. Any transmission of PI is at your own risk.
• 10.d. Our Duty: We are not responsible for bypassing of any privacy or security measures, or settings contained on the Platform.

11. OTHER WEBSITES

We may employ third parties to facilitate our Service (“Service Providers”), to perform Service-related services or to assist us in analyzing how our Service is used. These third parties have access to your PI only to perform said tasks on our behalf and are obligated not to disclose or use it for any other purpose. Though our Platform may contain links to third-party owned and/or operated websites or mobile applications, we have no control over such. Accordingly, we assume no liability for their data practices. We suggest that you review their policies, if any, prior to providing such with any information.

12. CONTACT INFORMATION

For questions or comments about this Policy contact us at legal@curbngo.com.

13. DPO

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your PI, please contact the DPO at legal@curbngo.com.

14. RETENTION

When the need to process your PI ceases, we will either delete, de-identify or anonymize it, or, if not possible (i.e., as your PI has been stored in archives), we will securely store your PI and isolate it from any further processing until deletion is possible. We retain PI as long as reasonably necessary to provide the Platform, execute this Policy or as otherwise required by law.

• 14.a. Duration of Retention Examples
  • 14.a.i. When You Interact with Business Expansion Functions: We may retain PI as long as necessary to provide you with your request for information or other responses.
  • 14.a.ii. Opening an Account: We may retain your PI for as long as your account is active, or to comply with our legal duties, preserve and protect our rights as allowed by law, resolve disputes, maintain security, prevent fraud and enforce our agreements.
• 14.b. Personal Data Retention Periods
  • 14.b.i. Except as otherwise permitted or required by applicable law or regulation, we only retain PI for as long as necessary to fulfill its purpose, as required to satisfy any duties, or as necessary to resolve disputes. To determine the appropriate retention period for PI, we consider the amount, nature, and sensitivity of PI, potential risk of harm from unauthorized use or disclosure, the purposes, and any legal requirements.

FOR CALIFORNIA CONSUMERS

Updated May 28, 2024

1. CHOICES ON USE AND DISCLOSURE

The data rights below pertain only to Californian, data subjects to the extent such rights are explicitly granted to them under applicable law

• 1.a. Tracking Technologies: You can set your browser to alert you when cookies are being sent. Details of managing flash cookies can be found on the Adobe Platform. If you alter cookies, please note parts of this site may then be inaccessible or not function properly.
• 1.b. Disclosure of Your Data: If you do not want us to use your PI for promotional purposes, you can opt-out by emailing optout@curbngo.com. This opt-out does not apply to any result of a purchase, service or any other transaction.
• 1.c. Accessing and Correcting Your Information
  • 1.c.i. We respond to data rights requests within a reasonable time. You can review and change your PI by providing privacy@curbngo.com with ample verification that it is in fact you who is responding. In addition, you can request deletion of your PI through the account deletion link provided on our Platform
  • 1.c.ii. You may also email us to exercise any data right or with specific questions about direct marketing. We cannot not delete your PI except by also deleting your account. We will not change PI if we believe it would violate any law or legal requirement or cause the data to be incorrect.
  • 1.c.iii. If you delete your posts to the Platform, copies of such may remain in cached and archived pages or may have been copied or stored by other users. Any deletion request will be governed by our retention policy.
• 1.d. Your Data Rights
  • 1.d.i. Right to be Informed. The right to be informed about the processing of your PI. This Policy is designed to inform of how your data is processed and describe your rights.
  • 1.d.ii. Right of Access. You have the right to access your PI and supplementary data to be aware of and verify the lawfulness of processing.
  • 1.d.iii. Right to Rectification. You may have PI rectified if it is inaccurate or incomplete.
  • 1.d.iv. Right to Erasure. You have the right to request deletion or removal of your PI where there is no compelling reason for its continued processing. We may not delete if necessary for the purpose of free speech or another right provided for by law or to comply with the Electronic Communications Privacy Act.
  • 1.d.v. Right to Restrict. You have the right to block or suppress processing of your PI.
  • 1.d.vi. Right to Data Portability. You have the right to obtain and reuse PI that can be clearly linked to you, for your purposes. We will send you a copy in a commonly used and machine-readable format.
  • 1.d.vii. Right to Object. You have the right to object when processing is based on legitimate interests, for the public interest, direct marketing, and for scientific research.
  • 1.d.viii. Automated individual decision-making. You have the right not to be opined upon based solely on automated processing, including profiling. which produces legal or similarly significant effects. In the event automated decision making is used you may request human intervention prior to any automated decisions and at any time being utilized, request logic information, significance or consequences. 1.d.ix. Right to Make a Complaint with a Supervisory Authority or Seek a Judicial Remedy. 1.d.x. Request Fulfillment. We typically fulfill any such request without delay and no later than one month after its receipt. If we are not required to fulfill such or there is a delay, we will provide the rationale via email. Responses are provided free of charge, unless requests are patently unfounded or excessive, especially due to redundancy. You will never be discriminated against due to exercise of these rights or any others.
• 1.e. Commercial use: The California Privacy Rights Act defines Sale of data which may include allowing third parties to receive information about you that may be of value to such parties even if we are not benefitting financially from such. If you wish to opt out of this form of use or anything else that may be deemed a sale, please e-mail privacy@curbngo.com.

FOR CANADIAN USERS

Updated May 28, 2024

1. BACKGROUND

The provisions below pertain to residents of Canada and address relevant federal or provincial privacy laws or regulations, including PI Protection and Electronic Documents Act (“PIPEDA”).

• 1.a. Consent
  • Usually, we will proffer notice and/or request consent (express or implied) at the time of PI collection if required by law. Usually, you may change or withdraw your consent at any time subject to legal or contractual duties and reasonable notice.
• 1.b. Accessing and correcting PI
  • Subject to the relevant law and nature of relationship with us, you have the right to request, free of charge, access and to correct PI we hold and potentially to suppress, delete or else modify how we use your PI. Such rights requests can also be submitted to us through the below channels:
  • • By email: legal@curbngo.com
  • • By phone (toll-free)
  • Please identify what PI you seek. We will comply as soon as reasonably practicable. Once a request has been submitted, we may request more information to evidence to verify your identity or help us respond. additional information in order to verify your identity or to provide additional details to help us respond to your request. Note that in some instances, we may refuse to act or limit your rights, as permitted by the applicable law. If we cannot provide you with access to your PI, we will explain, subject to any legal restrictions. In some instances, residual data may remain on our databases and other records, which, due to applicable law or as part of Platform that are in the process of being carried out, will not be removed or changed. We will also retain data relating to your request for recordkeeping and compliance.
• 1.c. International Transfers
  • PI processed herein is processed mainly in the United States. However, as we are international with many business facets, and global third parties, your data may be sent anywhere that we do business or maintain third-parties relationships. When you provide PI to us, you consent to the transfer of such and the processing of your PI in this manner. International transfers made will be in accordance with this Statement and applicable law. We also impose appropriate contractual safeguards on third parties and other parties that might access the information.
• 1.d. Right to file a complaint
  • If you believe any privacy law relating to the protection of your PI or the practices detailed herein have been violated, you may file a complaint with our Head of Privacy:
  • • By email: legal@curbngo.com
  • • By phone (toll-free)
  • We will investigate all complaints. If, after an investigation, your complaint is deemed justified, we will take appropriate steps to mend the issue, including, if necessary, amending our policies and practices. If you are not satisfied with the results, you may exercise the remedies available by contacting the Office of the Privacy Commissioner of Canada at the address below:
  • Office of the Privacy Commissioner of Canada 30 Victoria Street Gatineau, Quebec K1A 1H3 https://www.priv.gc.ca

FOR EU USERS

Updated May 28, 2024

The following supplements the general Policy and applies solely to European Union (EU) residents. If there is a conflict between EU Supplement and main Policy, Supplement prevails.

Data controller: Under GDPR the person tasked with processing and decides alone or in cooperation with others which PI is being collected as well as purposes and means with regard to the processing of that PI. We are the Controller in this Agreement. Provisions below supplement the main Policy. To the extent that there is a conflict, this Addendum C shall prevail over the main Policy. As a data controller, we may rely on “data processors” (as defined within the GDPR) and have engaged various third-party service providers to provide the Services as well as other purposes described in the main Policy.

A. LEGAL BASIS FOR PROCESSING

We collect and process your PI based on the following legal bases:

• to perform our contract with you, as described in the main body of the Privacy Statement;
• for the purposes of complying with legal obligations or in connection with related claims;
• to pursue legitimate interests of effectively managing and improving our business; and
• if applicable, with your consent.

We will only use and process your PI in accordance with the GDPR, and any local and/or replacement legislation governing the processing of PI. If you fail to provide certain data when requested, we may not be able to perform the contract we have entered (such as providing Services), or we may be prevented from complying with our legal obligations.

B. INTERNATIONAL TRANSFERS

For purposes stated in the Policy, we may transfer the PI we collect to countries that have not been found to provide an adequate level of data protection by the European Commission. In particular, we may transfer your PI to the United States. In such instance, we have made required contracts, considering standard provisions imposed by the Commission, to ensure your PI receives an adequate level of data protection in that country. We use appropriate safeguards to transfer PI to other jurisdictions, and where required, we have implemented the Commission's standard contractual clauses, or other recognized safeguards, for transfer purposes. To see a copy of clauses or more information email privacy@curbngo.com.

C. SENSITIVE PI (SPI)

We may collect SPI for certain Services described in main Policy if required under the applicable law or local requirements. If permitted by law, we may also collect SPI if you provide it to us.

D. DATA RIGHTS

You have additional rights regarding how your PI is processed, including the right to request:

• access and obtain a copy of your PI;
• request the transfer of your PI to you or another company in a structured, commonly used and machine-readable format;
• request rectification of your PI when it is inaccurate or incomplete;
• request erasure of your PI, where permitted under the law, such as where the information is no longer necessary or lawful for us to store or where your information is outdated;
• restrict or object to the processing of your PI (as applicable); and

You may withdraw your consent any time where consent is basis for processing. However, if you withdraw consent, you may not be able to use the programs and services where you provided such consent. Your rights will be limited as per set out in applicable data protection law.

You may exercise the above rights free of charge by submitting your request to privacy@curbngo.com. Subject to law, we may charge a reasonable fee or refuse to act on a request if it impacts the rights and freedoms of others, prejudice the execution or enforcement of the law or interfere with pending or future litigation. You may also complain about processing, see below.

E. CHILDREN

Our Services are not directed at children under the age of 16, and we do not knowingly, collect or solicit PI from children at such age. If you believe that a child under 16 has provided PI to us, the child's guardian should contact us to remove. If we learn that any PI, we collected has been provided by a child under the age of 16, we will promptly delete that PI.

F. CONTACT US

If you have data protection questions, you can reach us at:

Email: privacy@curbngo.com

G. LODGING A COMPLAINT

If you are dissatisfied of the processing of your PI by the Platform, you have a right to lodge a complaint with the Data Protection Commission in your Country.