UPDASH PRIVACY POLICY

UpDash ("UpDash", "we", "us", "our") is committed to protecting your personal data in accordance with the Data Protection Act 2017 of Mauritius.

This Privacy Policy explains how we collect, use, process, store, disclose, and protect personal data when you use our website, mobile applications, and related services (the "Platform").

Contact: legal@updash.mu

UpDash Technologies Ltd

Republic of Mauritius

Email: legal@updash.mu

UpDash acts as Data Controller for customer and driver personal data processed through the Platform.

UpDash processes personal data for the following purposes and lawful bases:

UpDash may use automated analysis and profiling to detect fraudulent or abusive behavior, including repeated refund abuse, suspicious complaint patterns, or other activity that may indicate misuse of the Platform.

Where fraud or serious abuse is confirmed following investigation, UpDash may permanently restrict an account.

Users may contact UpDash Support to request review of a restriction decision.

UpDash retains personal data only as long as necessary for the purposes described in this Policy, and as required for compliance, tax, audit, and fraud prevention.

Upon a verified account deletion request:

• The account is deactivated (soft deleted).
• Personally identifiable information (PII) is anonymized within five (5) days.
• Order and wallet records may be retained in anonymized form for legal, tax, audit, and fraud prevention purposes.

Some UpDash mobile apps may also provide an in-app deletion option or a public web form for deletion requests. Where app-specific deletion options exist, they are described on the relevant app privacy page.

Anonymization is intended to be irreversible.

UpDash uses secure cloud infrastructure providers, including Microsoft Azure (Central India region) and Firebase services, to host and operate parts of the Platform.

Accordingly, personal data may be processed outside Mauritius in jurisdictions where these providers (or their subprocessors) operate.

Where cross-border processing occurs, UpDash implements appropriate technical and contractual safeguards intended to protect personal data in accordance with applicable data protection laws.

UpDash implements industry-standard safeguards, which may include:

• Encryption in transit (TLS)
• Role-based access controls
• Secure cloud infrastructure configuration
• Audit logging and monitoring
• Tokenized payment processing via third-party PCI-compliant providers
• Rate limiting and abuse detection

No system can guarantee absolute security. You are responsible for keeping your credentials confidential.

UpDash may disclose personal data:

We share limited personal data (first name, last initial, phone number, and delivery address) with the assigned Vendor and Driver solely for the purpose of preparing and delivering your Order. Vendors and Drivers are required to use this data strictly for operational purposes and not for marketing or independent use.

• To payment processors to complete payment/refund processing.
• To cloud/technical service providers for hosting, analytics, messaging, and platform operations.
• Where required by law or valid government/court requests.
• In corporate transactions (e.g., merger, acquisition), subject to appropriate protections.

UpDash does not sell personal data.

UpDash may use cookies and similar technologies on the web Platform for functionality, security, analytics, and performance. You can control cookies via your browser settings. Some features may not function properly if cookies are disabled.

Under the Data Protection Act 2017 (Mauritius), you may have rights to:

• Access your personal data
• Rectify inaccurate data
• Request erasure (deletion)
• Restrict processing
• Object to processing
• Request data portability (where applicable)
• Lodge a complaint with the Mauritius Data Protection Office

Requests may be sent to: legal@updash.mu.

App-specific request paths may also be available on the relevant mobile app privacy page.

UpDash may verify your identity before processing requests.

UpDash sends promotional communications (email and push notifications) only where you have enabled/consented to such communications. You may opt out at any time via unsubscribe links or device settings.

Transactional communications (e.g., order confirmations, cancellations, refunds) may be sent as required to provide the service.

If restricted goods are offered in the future:

• UpDash may require age verification and collection of government-issued ID.
• ID copies are stored securely for 30 days for compliance/dispute purposes.
• ID copies are permanently deleted after the retention period.
• Access is restricted to authorized personnel on a need-to-know basis.

Driver personal data is processed for:

• Identity verification and onboarding
• Regulatory and compliance requirements
• Delivery operations and performance
• Safety and fraud prevention

Driver license and vehicle registration documents are retained for one (1) year after termination, then permanently deleted.

UpDash may update this Privacy Policy from time to time. The most current version will be made available on the Platform. Material changes may be communicated through the Platform.

For privacy-related inquiries:

Email: legal@updash.mu

Republic of Mauritius