Privacy & Data Protection Policy

1. Introduction

1.1 This Privacy & Data Protection Policy (the "Policy") explains how DADATO collects, uses, shares, protects and retains personal information when you use our websites, apps and the six DADATO services: DatoHub, DatoPay, Dato Delivery, DatoGlobal, DatoCargo and DatoAccess.

1.2 We are committed to handling personal information lawfully, fairly and transparently, and in accordance with applicable data-protection law, including, in Djibouti, the personal-data protection provisions of the Digital Code (Code du Numérique).

1.3 Capitalised terms not defined in this Policy have the meaning given in our General Terms of Use.

2. Who is responsible for your information

2.1 The controller of your personal information is [BUSINESS DECISION REQUIRED — legal entity name], [BUSINESS DECISION REQUIRED — registered address] ("DADATO", "we", "us"). Where Market-Specific Terms identify a different DADATO entity for a market, that entity is the controller for that market.

2.2 Data protection officer. [LEGAL REVIEW REQUIRED — DPO designation]. Privacy enquiries may be sent to [BUSINESS DECISION REQUIRED — privacy contact email].

2.3 Independent controllers. Some Third-Party Providers decide for themselves how to use the personal information they receive, for example Sellers fulfilling your Order, Payment Providers processing a payment, airlines, embassies, universities and hospitals. They are responsible for their own processing under their own privacy notices.

3. Whose information we process

This Policy applies to: visitors to our websites and apps; Buyers; Sellers and their representatives; Riders and rider applicants; Business Users, Suppliers and their contacts on DatoGlobal and DatoCargo; travellers, students, patients and companions using DatoAccess; people who contact us; job applicants; and representatives of our business partners.

4. Our data-protection principles

We process personal information only for specified and legitimate purposes; collect only what we need; keep it accurate; retain it no longer than necessary; protect it with appropriate security; and respect your rights. We build privacy into our products from the design stage and, by default, process only the information necessary for each purpose.

5. Information we collect

5.1 Information you give us

5.2 Information we collect automatically

Device and log data (device type, operating system, app version, IP address, identifiers, crash data), usage data (pages viewed, searches, clicks), approximate location from your IP address, and — where you allow it or where it is needed for a delivery — precise device location. See our Cookie & Similar Technologies Notice.

5.3 Information from others

6. How we use your information and our legal bases

Where we rely on legitimate interests, we balance them against your rights and freedoms. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out.

7. Service-specific information

7.1 DatoHub. We share your name, delivery details and Order information with the Seller who fulfils your Order, and we show Sellers' business identity to Buyers.

7.2 DatoPay. Payment card and wallet credentials are processed by Payment Providers. [TECHNICAL REVIEW REQUIRED — confirm DADATO does not store full card numbers]. We receive payment status, references and limited payment-method details needed for reconciliation, refunds and fraud prevention.

7.3 Dato Delivery. Riders receive the information needed to complete a delivery, such as your name, delivery location, landmark and contact method. Where available, contact may be routed through masked numbers or in-app messaging. We collect Riders' location while they are on duty or carrying out an assignment, to dispatch orders, show delivery progress, ensure safety and resolve disputes.

7.4 DatoGlobal. We share Business User and Supplier contact and transaction information between the parties to an RFQ, quotation or purchase, and with inspectors you engage through the Platform.

7.5 DatoCargo. We share shipment, consignee and documentation details with carriers, freight forwarders, customs professionals and inspectors as needed to coordinate your shipment, and with customs or other authorities where required by law.

7.6 DatoAccess. We share the information needed to deliver your request with the relevant airlines, hotels, transport providers, interpreters, universities, hospitals, clinics, embassies or consulates. Health information is collected only for medical-travel coordination, only with your explicit consent, and is shared only with the healthcare providers and facilitators you ask us to involve. DatoAccess does not provide medical advice.

8. Sensitive information

8.1 Sensitive information includes health data, biometric data used for identification, and information about criminal offences, among other categories defined by Applicable Law.

8.2 We process sensitive information only where Applicable Law allows, usually with your explicit consent, and apply additional safeguards, including restricted access and encryption. We do not use sensitive information for marketing.

8.3 Where Applicable Law requires prior declaration to, or authorisation from, the data-protection authority before certain processing, we will complete that formality before starting the processing.

9. Automated decisions

9.1 We use automated tools to help detect fraud, abuse and prohibited listings, and to rank and match search results, Riders and offers.

9.2 We do not make decisions based solely on automated processing that produce legal effects concerning you, or similarly significantly affect you — such as permanently suspending an Account — unless permitted by Applicable Law and with appropriate safeguards. You may request human review, express your point of view and contest the decision.

10. Who we share information with

We share personal information only as described in this Policy:

• Sellers, Buyers, Riders, Suppliers and Business Users, to the extent needed for a transaction;
• Payment Providers, to process payments, refunds and payouts and to prevent fraud;
• Logistics providers, carriers, customs professionals and inspectors, for delivery and freight services;
• DatoAccess providers, to deliver the support you request;
• Service providers acting on our behalf (processors), such as hosting, communications, customer support, analytics and verification providers, under written contracts that require them to protect your information and use it only on our instructions;
• Professional advisers, such as lawyers, auditors and insurers;
• Authorities, where we are legally required to disclose information, or where disclosure is necessary to protect the rights, safety or property of Users, the public or DADATO;
• A successor business, in connection with a merger, acquisition or restructuring, subject to equivalent protections.

We do not sell your personal information.

11. International transfers

11.1 Some of our providers, and some DatoGlobal, DatoCargo and DatoAccess services, are located outside the country where you live, including in countries such as China, the United Arab Emirates, India and Türkiye. [TECHNICAL REVIEW REQUIRED — hosting countries].

11.2 We transfer personal information outside Djibouti only where the destination provides an adequate level of protection, where appropriate safeguards are in place and authorised as required by Applicable Law, or where another lawful ground applies — for example, where the transfer is necessary to perform a contract you have requested, such as a booking with a provider abroad. [LEGAL REVIEW REQUIRED — transfer mechanisms]

12. How long we keep information

We keep personal information only as long as necessary for the purposes described in this Policy, including to meet legal, accounting, tax and dispute-resolution requirements. Retention periods depend on the category of information and the purpose. [POLICY DECISION REQUIRED — retention schedule]. When information is no longer needed, we delete or anonymise it.

13. Security

We use appropriate technical and organisational measures to protect personal information, including encryption in transit, access controls based on the principle of least privilege, monitoring, and staff confidentiality obligations. No system is completely secure; if you suspect a security issue, please contact us promptly.

14. Personal data breaches

If a personal data breach occurs, we will assess it promptly, take steps to contain it, notify the competent data-protection authority within the time required by Applicable Law, and inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

15. Children

Our services are not directed at children below the minimum age stated in our General Terms of Use. Where a DatoAccess service concerns a minor (for example, a student or a child patient), we process that minor's information only with the consent of, and at the request of, a parent or legal guardian, as required by Applicable Law.

16. Your rights

16.1 Subject to the conditions and exceptions in Applicable Law, you have the right to:

• be informed about how your information is used;
• access your personal information and obtain a copy;
• rectify inaccurate or incomplete information;
• erase your information in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time;
• portability — receive information you provided in a structured, machine-readable format and have it transmitted to another controller, where applicable;
• withdraw consent at any time, where processing is based on consent;
• not be subject to solely automated decisions with legal or similarly significant effects, as described in section 9;
• give directions about the handling of your information after your death, where Applicable Law provides for this.

16.2 How to exercise your rights. Use the privacy settings in your Account or contact us at [BUSINESS DECISION REQUIRED — privacy contact email]. We may ask you to confirm your identity. Exercising your rights is free of charge, except where requests are manifestly unfounded or excessive. We will respond within the time required by Applicable Law.

16.3 Complaints. If you are not satisfied with our response, you may lodge a complaint with the competent data-protection authority. In Djibouti, the Digital Code establishes the Commission Nationale de Protection des Données à Caractère Personnel. [LEGAL REVIEW REQUIRED — authority contact details and operational status].

17. Marketing choices

You can opt out of marketing messages at any time using the unsubscribe link, by replying STOP where offered, or through your Account settings. You will continue to receive service messages about your Account and transactions.

18. Third-party websites and services

The Platform may link to third-party websites and services, including Payment Provider pages and provider booking systems. Their privacy practices are governed by their own notices.

19. Regulatory formalities

Where Applicable Law requires us to declare processing activities to, or obtain authorisation from, a data-protection authority, we do so before beginning the relevant processing.

20. Changes to this Policy

We may update this Policy from time to time. We will publish the updated version with a new version number and effective date and, where changes are material, notify you in advance through the Platform or by email.

21. Languages

This Policy may be published in English, French and Simplified Chinese. [LEGAL REVIEW REQUIRED — AUTHORITATIVE LANGUAGE / PRECEDENCE]

22. Contact

[BUSINESS DECISION REQUIRED — legal entity name] [BUSINESS DECISION REQUIRED — registered address] Privacy contact: [BUSINESS DECISION REQUIRED — privacy contact email]