Privacy Policy

1. Introduction

1.1 This Privacy Policy explains how we collect, use, disclose, and protect your Personal Information.

1.2 We comply with the Privacy Act 1988 (Cth), Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme.

2. Information We Collect

2.1 We collect the following categories of information:

• Identity information – name, date of birth, government-issued ID
• Contact details – email address, phone number
• Location data – precise GPS location while you use the app and during trips, and in the background if you turn on Automatic Transit (see section 4)
• Trip data – routes, timestamps, and transport usage records
• Device information – IP address, browser type, and device ID
• Usage data – cookies, log files, web beacons, and analytics data
• Biometric data – facial recognition and fingerprint data
• Enterprise data – transaction records and ESG verification data

3. Automatic Data Collection

3.1 We automatically collect “Device Information” including:

• IP address, browser type, and time zone
• Pages visited and interaction patterns
• Referral sources and usage analytics

3.2 This data is collected via cookies, log files, and tracking technologies such as web beacons and analytics scripts.

4. Location Data

4.1 The CarPool mobile app collects precise location data from your device (latitude and longitude, accuracy, speed and direction of travel). We only collect it after you have seen an in-app explanation and granted location permission.

4.2 While you use the app, including during an active trip, we use your location to:

• show rides and pickup points near you
• set your pickup and drop-off points on the map
• share your live position with the other members of your pool during a trip
• verify completed trips and calculate the CO₂ you save
• send your position with an SOS alert

4.3 Automatic Transit (background location). Automatic Transit is optional and off until you turn it on. If you turn it on, CarPool collects location data even when the app is closed or not in use, to detect bus, train, tram or car trips you share with other CarPool users and to calculate the CO₂ you save. It also uses your device's motion activity (for example walking or in a vehicle) to save battery. A notification is shown while Automatic Transit is running. Location collected in the background is used only for Automatic Transit.

4.4 How location data is shared:

• Location data is sent to and stored on CarPool servers.
• During a trip, your live position is shared with the other members of your pool.
• If you raise an SOS, your position is sent to the other members of your pool and to the CarPool safety team.
• Automatic Transit location is compared on our servers with other users' trips to detect shared travel. It is never shown to other users.
• We do not sell location data or use it for advertising.

4.5 Retention. Automatic Transit location data that does not support a confirmed trip is deleted after 30 days. Location data that supports a confirmed trip is kept as part of that trip's verification record, as described in section 9.

4.6 Your choices. You can turn off Automatic Transit at any time in the app's Settings, and you can withdraw location permission at any time in your device settings. Without location access, features that depend on it, such as finding nearby rides, live trip sharing and trip verification, will not work.

5. Purpose of Collection

5.1 We use Personal Information to:

• Facilitate carpooling coordination and public transport tracking
• Verify trips and prevent fraud
• Calculate CO₂ reduction
• Generate ESG reporting outputs
• Improve platform performance and conduct analytics
• Communicate with Users
• Screen for risk or fraudulent activity

6. Sharing of Information

6.1 We may share Personal Information with:

• Service providers – hosting, analytics, and support vendors
• Other members of your pool – your live position during a trip, and with an SOS alert (see section 4)
• Enterprise Buyers – aggregated and anonymised data only
• Legal and regulatory authorities – where required by law

6.2 We do not sell Personal Information or Biometric Data.

7. Analytics and Advertising

7.1 We may use analytics tools (e.g. Google Analytics) to understand user behaviour and improve platform performance.

7.2 Users can opt out of tracking tools where supported by the relevant tool or device settings.

8. Biometric Data

8.1 Biometric data is used for identity verification and trip authentication.

8.2 Biometric collection is mandatory for core platform features and cannot be opted out of while retaining full platform access.

8.3 All biometric data is encrypted and stored securely using industry-standard controls.

8.4 Withdrawal of consent to biometric data collection will result in loss of access to core platform features or full account termination.

9. Data Retention

9.1 Personal data is retained only for as long as reasonably necessary for the purposes for which it was collected.

9.2 Certain data may be retained for longer periods where required by law, for compliance purposes, or to protect our legitimate interests including fraud prevention, dispute resolution, and audit integrity.

10. Cross-Border Disclosure

10.1 Data may be stored or processed overseas via our cloud infrastructure and third-party service providers.

10.2 By using the Platform, you consent to such international transfers of your Personal Information.

11. Your Rights

11.1 You may submit a request to:

• Access your Personal Information held by us
• Correct inaccurate or outdated information
• Delete your Personal Information, subject to legal and platform integrity requirements

11.2 To exercise any of these rights, contact us at: support@carpoolapp.com.au

12. Complaints

12.1 If you have a privacy concern or complaint, please contact us in the first instance to allow us to attempt resolution.

12.2 If your complaint is not resolved to your satisfaction, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

13. Changes to This Policy

13.1 We may update this Privacy Policy from time to time to reflect changes to our practices, legal obligations, or platform features. The current version will always be available on the Platform or our website.

14. Contact