Privacy Policy Last updated: 5th June 2024 We take privacy seriously and have updated our policy to be compliant with leading edge General Data Protection Regulation (GDPR) requirements. That means that this Privacy Policy is intended to be concise, clear and fair. Please note the Privacy Policy for the SIRA trial is available here 1. WHO IS COLLECTING THE DATA? The data is collected by GOFAR Pty Ltd. We’re a telematics specialist based in Sydney, Australia with customers in over 50 countries around the world. You can visit our offices at 11 York Street, Sydney, NSW 2000. In this Privacy Policy, ‘GOFAR”, “we”, “us” or “our” mean GOFAR PTY LTD (ACN 610 842 656) and our related bodies corporate, whilst “you” means the users of our products and services, and “Site” means www.GOFAR.co We recognize the trust you place in us and don’t take it for granted. 2. OUR PRIVACY POLICY We work hard to create products and services that provide fantastic user experiences for drivers. In providing our products and services, we collect certain information from our users. GOFAR only collects personal information about you if you voluntarily choose to share it with GOFAR. We are committed to respecting your privacy and we take seriously our responsibility to protect your personal information. Our Privacy Policy sets out how we collect, use, store and disclose your personal information. GOFAR does not share, rent or sell information concerning GOFAR’s customers or other users of its services, to third parties except with our customers consent as disclosed in our Privacy Policy. 2.1 Security is at our core Ensuring your data is secure is one of the reasons we build our own hardware. We use industry-leading security practices like PIN protection on all devices, secure passwords and AES encryption on all data transmitted from device to phone to cloud. 2.2 Your data is yours. Our job is to take care of it for you The data created when you drive is securely hosted on our servers and is yours to explore, download and use. You can also stop using GOFAR at any time. We will permanently delete your personal data from our servers at your request. 2.3 We anonymize data to create interesting insights Our mission is to make car ownership easier, less harmful to the environment and safer for drivers and organisations. To achieve this we use aggregated, anonymized data to research driving patterns and vehicle performance, which we may publish. We may also create and even sell industry reports, e.g. fuel economy by car brand by speed, or The most common engine problems for different car brands. These reports are based on aggregated and anonymized data — they will never contain your identity or personally identifiable information. 3. WHAT DATA IS BEING COLLECTED There are several ways for you to share personal information about yourself with GOFAR and to use the core functionality of the services, you must first complete the registration form within the App and agree to our Terms and Conditions. During registration you will be required to provide personal information such as your name, email address and vehicle(s) details. 3.1 We collect three types of data We collect three types of data – telematics and location data as that is primarily what our product does, customer data so we can communicate with customers and ship products to them and marketing data so that we can invest as little money as possible in advertising and as much as possible in product development and low prices. 3.2 Telematics Driving Data & Location Data 3.2.1 The telematics products we make necessarily require that we collect certain information from our customers on behalf of those same customers including: 3.2.2 Diagnostic data gathered from a car’s OBD2 diagnostic port. Specifically this includes engine error codes, battery voltage, RPM, fuel economy, speed, fuel level, emissions, and throttle data. Customers can access this to manage their car health better 3.2.3 Trip log data – specifically, the time trips start and end, the distance driven, the trip purpose and the trip route. Customers generally use this for convenient tax or expense logging or to help with learner log books. 3.2.4 G-force data derived from accelerometer readings in the GOFAR adapter. This helps customers determine how smoothly they are accelerating and braking. 3.2.5 Location data and GPS tracking is one of our most popular features, precisely because most customers use GOFAR to log their work driving, including where they drove. 3.2.5.1 Location Privacy Settings: If you want to log your driving but not your GPS location data then we have designed GOFAR to suit your privacy needs and you can turn off the GPS Location tracking in Settings:Privacy:Allow GPS at any time. 3.2.5.2 If GPS Location Tracking is Enabled – this allows the app to store your location data, but only while your vehicle is being driven. Location data – such as the origin, destination and route of your trip make the classification of work trips much easier and more accurate and enhance the overall value of the app. For these reasons, nearly all our customers choose to enable Location Tracking. 3.2.5.3 If GPS Location Tracking is Disabled – then you can still use the app in full but the app will not record the start and end locations or the route of your trips. This may make it harder to correctly and quickly classify your trips as business or personal. 3.2.6 Competitive leagues – competition and shared achievement plays a part in helping to achieve GOFAR’s goal of making driving cheaper, greener and safer. To this end, we encourage our users to participate in our driving leagues and communities. You can opt out from this feature in the app in Settings:Privacy:Leaderboard or contacting us at support@GOFAR.co. 3.3 Customer Operational Data 3.3.1 Customers consent to provide certain information that either improves the experience of owning a car, or that GOFAR simply requires to operate and fulfil our obligations to the customer. This includes: 3.3.2 Their car make, model, fuel type, year, country (so we can tell them if it’s compatible with GOFAR). Customers can choose to provide an email so that they also get an email confirmation of their compatibility information but this is optional and we will provide the compatibility information on screen even if no email is provided. 3.3.3 Their address and phone number (so we can organise shipping and alerts) 3.3.4 Their email (so we may let them know about car compatibility, service offers and product updates). 3.3.5 Their renewal dates or other calendar alerts (so we can organise a service quote for them or remind them when insurance is due to expire, a service is due or tyres need to be pumped up). If the customer requests it we will use renewal information to conveniently organise a quote for them (such as a service quote, a roadside assistance quote or an insurance quote). The customer benefits from not having to fill in all this information again and it is generally a convenient and easy way for a customer to get a better deal if they so wish. 3.3.6 We store this information in a Customer Relationship database. Any email we send out allows you to opt out of communications with us. 3.4 Marketing data 3.4.1 Like any company we seek to efficiently find new customers and in so doing we will sometimes store marketing information provided by these customers. We also run marketing optimisation and analytics software on our website (specifically Segment, Drift, MixPanel and Google Analytics). We use this software to avoid wasting money on marketing unduly and it keeps our prices down to the benefit of all. 3.4.2 Marketing Data includes information from cookie tracking on our website which helps us see which pages are more popular and which pages are clearest at explaining our product. You can see our Cookie Policy here www.GOFAR.co/Cookies. A cookie is a piece of information that the computer that hosts our Site gives to your browser when you access the Site. Generally, cookies work by assigning to your computer a unique number that has no meaning other than for the Site. GOFAR’s cookies do not contain any personally identifiable information. Most web browsers automatically accept cookies, but you can change your browser setting to prevent it from doing so. GOFAR uses the cookies to provide features such as personalization, to save your member ID and to keep track of your shopping cart. Our cookies help us analyze the usage of our Service and website. Cookies may also be placed by third-party analytics services that we use, such as Google Analytics. GOFAR may also use cookies to assist it in delivering content specific to your interests. Additionally, after you’ve entered your member ID and password during a session on GOFAR’s website, GOFAR saves that information so you don’t have to re-enter it repeatedly during that session. Please note that not accepting cookies may make certain features of the Site unavailable to you. 3.4.3 We may also use third-party marketing services that use cookies to market our products to you on external sites. You can choose to opt-out of this by using the “Do Not Track” feature of your browser. You can find out more information by visiting http://www.youronlinechoices.com.au/. 3.4.4 Information about you and your use of the Site may be aggregated with other information collected on the Site or otherwise used in ways that do not personally identify you or constitute personally identifiable information. This type of aggregated or statistical information may be used by us to improve the quality of the Site or for other purposes that we may deem appropriate. 3.4.5 We anonymize and aggregate the data we collect across many users and may share this aggregated data with our affiliates, business partners, and users. The aggregated data does not identify you personally. We may also disclose aggregated user statistics in order to describe GOFAR to current and prospective business partners and to third parties for other lawful purposes. Examples of anonymized and aggregate data include the average morning work commute time of our users, and the average monthly cost of petrol of our users. 3.4.6 GOFAR uses a credit card processing company to process your credit card information as required for your order and to ensure that your transaction is secure. This processing company does not retain, share, store or use your personally identifiable information for any other purposes. 3.4.7 Like most standard web site servers the GOFAR Site and apps also use log files. This includes internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks to analyze trends, administer the Site and track user’s movement in the aggregate. IP addresses, etc. are not linked to personally identifiable information. GOFAR may use Google Analytics as a method of tracking site statistics and user behavior on the Site. 3.4.8 By visiting the Site, you consent to GOFAR in using the data in the log files to administer the Site and to assist in diagnosing problems with GOFAR’s server. 3.4.9 We will also use email address to send special offers from GOFAR. To give you a sense of activity we send typically one email per month (and you can opt out at any time). 4. WHAT IS LEGAL BASIS FOR PROCESSING THE DATA? 4.1 The legal basis for processing the Telematics and Customer Operational data is both consent and contractual when a driver or organisation has directly purchased our product. 4.2 The legal basis for processing the marketing data is consent, in that we request the information and it is freely provided. 5. WILL THE DATA BE SHARED WITH ANY THIRD PARTIES? 5.1 The Telematics Data created when you drive is securely hosted on our servers and is yours to explore, download and use. You can also stop using GOFAR at any time and we will permanently delete your data from our servers at your request. Customers’ telematics information is for them. We do not share identifiable telematics records. 5.2 Customer Operational data is also not sold or shared. However we do, with Customers’ consent, need to provide certain limited information to partners in order to fulfil services. We work with reputable partners, as outlined below. 5.2.1 We use an external warehouse, National Products Fulfilments in Sydney, and they print out labels with address information on in order to send ship our products around the world. They only get the contact details that are required to ship the product. 5.2.2 We help customers by providing service quotes from highly rated local mechanics. If a customer has requested we organise a service or other quote for them then we will share the required information (on their car make and model) in order to get them a quote. If they want to be contacted by a mechanic partner for a quote then we will of course provide their contact information to our local partner. Currently we work with Sparesbox.com.au in the Sydney area. 5.2.3 We help customers with convenient, low cost assistance. If the customer has purchased roadside assistance then we will share their information with Digicall Assist, our roadside assistance partner. The customer can additionally consent to share their diagnostic data with our partner in order to help diagnose problems with their car. This expect that over time, this will allow us to resolve issues more quickly. 5.2.4 We will occasionally introduce new services, such as motor insurance, that we will offer to customers. If the customer agree to receiving a quote we will share the relevant information to get them that quote, without them needing to fill in all the information again. 5.3 Marketing information is not sold or shared for the use of third parties. We just use it to optimise our own services. 6. HOW LONG WILL THE DATA BE STORED FOR? 6.1 Telematics information is stored in line with the product purchased by the customer. Currently our existing customers have unlimited storage. Future products may be introduced with telematics data storage that lasts for shorter defined periods. 6.2 Operational and marketing data is stored in our CRM database. We store customer information until consent is removed. We store information from Customer leads until consent is removed or earlier if we deem that the customer does not wish to hear from us (but has not removed consent). 7. WHAT RIGHTS DOES THE DATA SUBJECT HAVE? 7.1 Transparent communication. You have the right to know what information we hold on you in our databases (for both CRM and telematics purposes). 7.2 Proper identification. Third parties might improperly attempt to exercise a data subject’s rights without proper authorisation to do so. In order to protect our customers, GOFAR will ask data subjects to provide reasonable proof of their identity before releasing information. 7.3 Timeliness. GOFAR is not a large multinational with a dedicated team focused on access requests, but we always aim to provide a timely response to all requests received and automated tools in our app and website where possible. 7.4 Self service. You can export all your trips from GOFAR’s app by going to Setting:Data Export 7.5 Erasure. You have the right to be forgotten. This means GOFAR will entirely delete all your personal information from our CRM and telematics databases. Please note your data may remain in our backup data for a period of time after it is deleted from our servers. 7.6 Opt out. You have the right to use our services without receiving marketing messages. Please note that entirely opting out from emails and other communications will make it difficult for us to deliver important service updates and notifications to you. 8. HOW CAN YOU RAISE A COMPLAINT? 8.1 If you believe that your rights have been infringed, please contact support@gofar.co in the first instance and address your request, question or complaint to the Data Controller. The Data Controller will attempt to remedy the situation. 8.2 Please include your name, email address and/or telephone number and clearly describe the reasons for your complaint. 8.3 If you feel you have not received an adequate answer from the GOFAR Data Controller, you may be able to file a complaint to with your relevant national Data Protection Authority. 9. OTHER PRIVACY POLICY TERMS, CHANGES, CONSENT AND DEFINITIONS 9.1 By providing personal information to us, you consent to our collection, use and disclosure of your personal information in accordance with this Privacy Policy and any other arrangements that may apply between us. We may change our Privacy Policy from time to time by publishing the changes on our website. We encourage you to check our website periodically to ensure that you are aware of our current policy. 9.2 Personal information includes information about an individual that is reasonably identifiable. For example, this may include information such as your name, age, gender, postcode, email or phone number. 9.3 By using our Hardware, Service, Site or App, you consent to us sharing your information with the third parties described above as described above. 9.4 To provide you with an enhanced user experience, you may choose to share your information with other people through our App or Site. In these circumstances, your Personal Data will still not be shared without your express consent, which is usually given in the form of a web page, email or app screen where you authorize the sharing of information. 9.5 External links 9.5.1 Our Site may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites. 9.6 Will this Privacy Policy change? 9.6.1 Our products and services (and our business) may change from time to time. As a result, attimes we may need to make changes to this Privacy Policy. We reserve the right to update or modify this Privacy Policy at any time and from time to time without prior notice. We may notify you by email or by a notice on our website if material changes are made to our Privacy Policy. By choosing to use of our Hardware and Services, you consent to our Privacy Policy applicable at the time. 9.6.2 In addition, when you apply for a job or position with us we may collect certain information from you (including your name, contact details, working history and relevant records checks) from any recruitment consultant, your previous employers and others who may be able to provide information to us to assist in our decision on whether or not to make you an offer of employment or engage you under a contract. To the extent allowable under the general law, this Privacy Policy does not apply to acts and practices in relation to employee records of our current and former employees. 9.7 Fees 9.7.1 We may choose to apply a fee for data access requests in line with national legal frameworks. 9.8 What if I have additional questions? We hope that this Privacy Policy answers your questions regarding the information we collect, how we use it, and what steps we’ve taken to protect it. If you have further questions, please write to us at support@GOFAR.co.