Privacy Policy

Shunpanda, Inc. ("Shunpanda", "we", "our", or "us") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data.

This policy applies to all information collected through our website (shunpanda.com), our iOS and Android mobile applications (the "App"), and any related services, features, or content (collectively, the "Service").

Please read this policy carefully. By creating an account or using the Service in any way, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of the Service immediately.

We collect information in three ways: information you provide directly to us, information collected automatically when you use the Service, and information we receive from third parties.

2.1 Information you provide to us

Account registration: Name, email address, phone number, and password when you create an account.

Profile information: Profile photo, company name, and any additional details you add to your account.

Driver verification data: For drivers, we collect your driver's licence number and class, national identity document (national ID or passport), vehicle registration certificate, vehicle insurance document, and profile photograph.

Payment and payout information: For customers, payment card details are tokenised and processed by our third-party payment providers — we never store your full card number. For drivers, we collect bank account details or mobile money account details (e.g. EcoCash, OneMoney) solely for the purpose of processing payouts.

Delivery information: Pickup and drop-off addresses, package descriptions, special handling instructions, delivery photographs, and any notes you provide when booking or completing a delivery.

Communications: Messages sent through in-app chat, support tickets, or any correspondence you send to us by email or other means.

2.2 Information collected automatically

Location data (mobile app): With your explicit permission, we collect precise GPS location data from the mobile app. For drivers, real-time location is collected while the app is in use (foreground) and, on supported devices, while the app is in the background during an active delivery. This data is essential to match drivers with nearby jobs and provide live tracking to customers. Location collection stops when no active job is in progress. You may revoke location permission at any time in your device settings, but doing so will prevent core features from functioning.

Device information: Device model, operating system version, unique device identifiers (including Android Advertising ID / Google Advertising ID, Apple IDFA/IDFV, and device push notification tokens), mobile network information, and time zone.

App usage data: Pages or screens viewed, features used, time and duration of sessions, button taps and in-app actions, crash reports, and performance diagnostics.

Log data: IP address, access times, referring URLs, browser type (for web), and HTTP request details.

Cookies and similar technologies: We use cookies, local storage, and similar tracking technologies on our website. See our Cookie Policy for full details.

2.3 Information from third parties

We may receive information about you from third parties including payment processors, identity verification providers, and publicly available sources, in order to verify your identity, detect fraud, or comply with legal obligations.

We use the information we collect for the following purposes, each based on a lawful basis under applicable data protection law:

To provide and operate the Service: - Create and manage your account - Match customers with suitable drivers - Process, dispatch, and track deliveries - Process payments and issue driver payouts - Verify driver identity and eligibility to work on the platform - Enable in-app communication between drivers and customers - Send transactional notifications (e.g. delivery status updates, payment confirmations, account alerts)

To improve and develop the Service: - Analyse usage patterns to improve product features - Debug crashes and performance issues - Conduct A/B testing and product research - Train and improve our driver-matching algorithm

For safety and security: - Detect, prevent, and investigate fraud, abuse, and violations of our Terms - Verify driver and customer identities - Ensure the physical safety of drivers, customers, and their goods - Comply with legal and regulatory obligations

For communications and marketing: - Send you service announcements and policy updates (required communications — cannot be opted out of) - Send you promotional emails and push notifications about new features and offers (you may opt out at any time) - Respond to your support requests and queries

Legal bases (GDPR): Depending on how you use the Service, our processing is based on: performance of a contract (delivering the core Service), compliance with legal obligations, our legitimate interests (fraud prevention, safety, product improvement), or your consent (marketing communications, optional data collection).

Our mobile application requests the following device permissions. All permissions are requested only when required for functionality and are explained in-app at the time of request.

Location (Precise / Background): Required for driver GPS tracking, job matching, and live delivery tracking. Background location is only active during an ongoing delivery.

Camera: Used to capture delivery proof-of-delivery photographs and to scan documents during driver onboarding. Optional for customers.

Photo library / Media access: Used to upload profile photos and access saved delivery photos. Access is only triggered when you explicitly choose to upload a photo.

Push notifications: Used to send delivery updates, job alerts, payment confirmations, and other time-sensitive information. You may disable push notifications in your device settings at any time.

Internet access: Required for the app to communicate with Shunpanda servers.

We do not access your contacts, microphone, calendar, or any other device resource beyond those listed above.

Our Service integrates third-party services that may collect data independently under their own privacy policies. By using our Service, you acknowledge these integrations.

Firebase (Google LLC): We use Firebase Analytics for usage analytics, Firebase Crashlytics for crash reporting, and Firebase Cloud Messaging for push notifications. Data may be processed in the United States. Google Privacy Policy: policies.google.com/privacy

Stripe: Used for card payment processing. Stripe handles all card data and is PCI-DSS Level 1 compliant. Stripe Privacy Policy: stripe.com/privacy

Mapbox / Google Maps: Used to provide navigation and mapping features in the driver app. These services may collect location data subject to their own policies.

Mobile money providers (EcoCash, OneMoney, Paynow): Used for mobile money payments and driver payouts in applicable regions.

Sentry: Used for application error tracking and performance monitoring.

We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We share information only in the following limited circumstances:

Between users to facilitate deliveries: When a delivery is booked, we share the customer's pickup/drop-off details and first name with the assigned driver, and we share the driver's first name, rating, vehicle details, and real-time location with the customer. Full contact details (phone numbers) are shared only within the in-app communication interface and are not exposed externally.

Service providers: We share data with vetted third-party vendors who process data on our behalf (cloud hosting, payment processing, analytics, identity verification, customer support tooling). All processors are bound by data processing agreements and may not use your data for purposes other than providing services to us.

Legal compliance and safety: We may disclose your information if required by applicable law, regulation, court order, or lawful request from public authorities. We may also disclose information where we believe it is necessary to prevent imminent physical harm or illegal activity.

Business transfers: If Shunpanda is involved in a merger, acquisition, asset sale, or insolvency proceeding, your personal data may be transferred as part of that transaction. We will notify you via email or prominent in-app notice prior to your data being transferred and becoming subject to a different privacy policy.

With your consent: We may share your information with third parties when you have given us explicit consent to do so.

Shunpanda operates globally. Your information may be transferred to and processed in countries other than the one you reside in, including countries that may not have the same data protection laws as your jurisdiction.

Where we transfer data from the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

By using the Service, you consent to the transfer of your data to the countries in which we and our service providers operate.

We retain personal data for as long as your account is active and for a period thereafter as necessary to fulfil the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Account data: Retained for the duration of your account plus 3 years after account closure, unless a longer period is required by law.

Delivery records: Retained for 7 years for tax, accounting, and legal compliance purposes.

Driver verification documents: Retained for the duration of the driver's engagement plus 5 years.

Support communications: Retained for 3 years from the date of last interaction.

Location history: Precision location data is anonymised or deleted within 90 days of collection, except where associated with an ongoing legal or fraud investigation.

To request deletion of your account and data, email privacy@shunpanda.com. We will process deletion requests within 30 days, subject to any legal retention requirements.

We implement technical and organisational security measures commensurate with the risk of processing your data, including:

• All data in transit is encrypted using TLS 1.2 or higher
• Sensitive data at rest (including driver documents and payment tokens) is encrypted using AES-256
• Access to personal data is restricted to employees and contractors with a legitimate business need, and is subject to role-based access controls
• We conduct regular security audits and penetration testing
• All employees with access to personal data undergo data protection training
• Incident response procedures are in place to detect and respond to data breaches

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by applicable law.

Despite our efforts, no security system is impenetrable. We cannot guarantee the absolute security of your information.

Depending on your jurisdiction, you have the following rights regarding your personal data:

Right of access: You may request a copy of the personal data we hold about you.

Right to rectification: You may ask us to correct inaccurate or incomplete data.

Right to erasure ("right to be forgotten"): You may ask us to delete your personal data, subject to certain exceptions (e.g., where retention is required by law).

Right to restriction of processing: You may ask us to limit how we use your data in certain circumstances.

Right to data portability: You may request your data in a structured, machine-readable format.

Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. If you object to marketing, we will stop immediately.

Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

California residents (CCPA/CPRA): You have the right to know what personal information is collected, the right to delete, the right to opt out of the sale or sharing of personal information (we do not sell data), and the right not to be discriminated against for exercising your rights.

To exercise any of these rights, contact us at privacy@shunpanda.com. We will respond within 30 days. We may require identity verification before fulfilling requests.

The Service is not directed to children under the age of 13 (or 16 in the European Union / European Economic Area). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at privacy@shunpanda.com. Upon verification, we will delete the child's information from our systems promptly.

We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and applicable children's data protection laws in other jurisdictions.

Our mobile application may use advertising identifiers (Apple IDFA / Android Advertising ID) to measure the effectiveness of our own marketing campaigns and to prevent ad fraud. We do not use these identifiers to serve third-party targeted advertising within the Shunpanda app.

You may reset or opt out of advertising identifier tracking through your device settings: - iOS: Settings → Privacy & Security → Tracking → toggle off "Allow Apps to Request to Track" - Android: Settings → Privacy → Ads → "Opt out of Ads Personalisation" or "Delete advertising ID"

We honour Apple's App Tracking Transparency (ATT) framework and will not track users who have not granted permission through the ATT prompt.

We send push notifications to your device to provide delivery updates, job alerts, payment confirmations, and other service-related information. For marketing notifications, we will request your permission before sending.

You may manage push notification preferences within the Shunpanda app under Settings → Notifications, or through your device's notification settings. Disabling push notifications does not affect the delivery of in-app messages or email notifications.

The Service may contain links to websites or services operated by third parties. This Privacy Policy does not apply to those third-party sites or services. We are not responsible for the privacy practices of any third party and encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send you an email notification (if you have an account) at least 14 days before the changes take effect
• Display a prominent notice within the app

Your continued use of the Service after the effective date constitutes your acceptance of the revised policy. If you do not agree with the changes, you should discontinue use and may request deletion of your account.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@shunpanda.com General enquiries: hello@shunpanda.com Company: Shunpanda, Inc.

We will respond to all privacy-related enquiries within 30 days.