HALEN: COMPREHENSIVE PRIVACY POLICY

Ride-Hailing • Delivery • Flight Booking • Vacation Rentals • Driver Operations

Halen Technologies Inc., a Delaware corporation doing business as "Halen" ("Halen," "we," "us," or "our"), operates a multi-service platform connecting users with transportation, delivery, travel, and hospitality services. This Privacy Policy explains how we collect, use, store, share, and protect personal information across all of our services, including:

• Ride-hailing and transportation services
• Food, grocery, and retail delivery services
• Flight search and booking services
• Vacation rental listing and booking services
• Driver, courier, and partner operations
• Our websites, mobile applications, and related digital properties

By accessing or using any Halen service, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree, you should discontinue use of our Services.

2. Scope and Data Controller Roles

This Privacy Policy applies to all services provided by Halen Technologies Inc. and its subsidiaries and affiliates. Halen acts in different capacities depending on context:

2.1 When Halen Is a Data Controller (or "Business")

Halen acts as a data controller or "business" under applicable privacy law when it determines the purposes and means of processing personal information. This includes the processing of rider, customer, driver, host, and guest data for our own platform operations, safety, fraud prevention, marketing, and business analytics.

2.2 When Halen Is a Data Processor (or "Service Provider")

Halen may act as a data processor or "service provider" when processing personal information on behalf of business customers, enterprise accounts, or third-party partners who direct how data is processed. In such cases, the business customer's privacy policy and instructions govern use of that data.

2.3 Service-Specific Scope

Different categories of users interact with different Halen services. The following table summarizes which sections of this policy are most relevant to each user type:

3. Information We Collect

We collect information in four main ways: (a) information you provide directly, (b) information collected automatically through your use of our Services, (c) information from third parties, and (d) service-specific information unique to each platform vertical.

3.1 Information You Provide (All Services)

The following categories of information may be collected from all users:

Account and Profile Information

• Full name, email address, phone number, and password
• Profile photo and preferred language
• Mailing and billing address
• Emergency contact information
• Date of birth (for age verification purposes)

Payment and Financial Information

• Payment card details (processed and tokenized by our third-party payment processor; Halen does not store raw card numbers)
• Bank account information for payouts (drivers, couriers, and vacation rental hosts)
• Billing address and payment preferences
• Tax information, including W-9 details and taxpayer identification numbers, where required by law

Communications and Feedback

• Messages and calls exchanged through in-app communication tools (which may be masked or recorded)
• Customer support communications and tickets
• Ratings, reviews, and feedback submitted about service providers, restaurants, hosts, or guests
• Survey and research responses

3.2 Information Collected Automatically

Device and Network Information

• Device type, model, operating system version, app version
• Device identifiers (e.g., IDFA, GAID, device serial number)
• IP address, browser type, mobile carrier, and language settings

Location Information

• Approximate and precise location data (via GPS, Wi-Fi, Bluetooth, cell towers, or other technologies) when the app is running in the foreground or background, depending on your device permissions
• Location data during trips, deliveries, and service transactions to enable routing, matching, pricing, and safety features
• Location data may be collected even when the app is in the background if you have enabled background location permissions

Usage and Analytics Data

• Dates and times of access, app features used, pages viewed
• Search queries, browsing history within the app, and clickstream data
• Crash logs and performance diagnostics
• Cookies, pixels, SDKs, and similar tracking technologies (see Section 5 for details)

3.3 Driver, Courier, and Service Provider Information

In addition to the general information above, drivers, couriers, and other service providers on our platform provide:

• Government-issued photo identification (e.g., driver’s license, state ID, or passport)
• Social Security Number or Individual Taxpayer Identification Number (for tax reporting purposes)
• Vehicle information: make, model, year, color, license plate, vehicle identification number (VIN)
• Vehicle registration and title documents
• Commercial auto insurance documentation
• Background check results and consent (processed by authorized third-party providers)
• Motor vehicle record (MVR) information
• Selfies and facial photos used for real-time identity verification (liveness checks)
• Banking and direct deposit information for earnings payouts
• Earnings, trip history, delivery history, and performance metrics

3.4 Flight Booking Service Information

When you use our flight booking services, we collect:

• Passport number, passport expiration date, country of issuance, and nationality
• Full legal name as it appears on government-issued travel documents
• Date of birth (required for airline reservations)
• TSA Known Traveler Number (KTN) and/or Global Entry / NEXUS number
• Redress Number (for travelers who have experienced screening difficulties)
• Airline frequent flyer program membership numbers and tier status
• Seat preferences, meal preferences, and accessibility or special assistance requirements
• Co-traveler names and contact information
• Travel insurance selections and related health disclosures, if applicable
• Itinerary details including flight numbers, departure/arrival airports, and dates
• Loyalty program credentials if linked to your account

3.5 Vacation Rental Guest Information

When you book vacation rentals through Halen, we collect:

• Government-issued ID (in jurisdictions where required by law or requested by hosts for verification)
• Number of guests and names of accompanying travelers, including minors
• Check-in and check-out dates and times
• Purpose of stay (where provided)
• Guest verification information, which may include facial photo matching
• Communication with hosts through our platform messaging system
• Damage deposit information and associated payment details
• Review and rating of the property and host

3.6 Vacation Rental Host Information

If you list a property on Halen as a host, we collect:

• Property address and detailed description
• Property photos, amenities, house rules, and availability calendar
• Pricing, discount settings, and minimum stay requirements
• Government-issued identification for host identity verification
• Tax identification number and business registration information (where applicable)
• Local short-term rental permit or license numbers (where required by local law)
• Banking and direct deposit information for payout processing
• Smart lock codes, access instructions, or other property access details shared with guests (encrypted and access-controlled)
• Security camera and recording device disclosures (hosts are required to disclose the presence of any surveillance devices in or around the property)
• Payout history, reservation records, and performance metrics

3.7 Grocery, Food, and Retail Delivery Information

In connection with delivery services, we also collect:

• Order details, including items, quantities, and merchant information
• Dietary preferences, restrictions, or allergen information (if provided)
• Prescription and pharmacy order information, if pharmacy delivery is offered (subject to applicable HIPAA and state pharmacy law requirements)
• Age verification data for alcohol, tobacco, or other age-restricted purchases
• Delivery instructions, access codes, and preferred drop-off locations
• Tip and gratuity preferences

4. How We Use Your Information

We use personal information for the following purposes. We collect and use only the information reasonably necessary for these stated purposes.

4.1 Providing and Operating the Services

• Enable and manage rider trip requests, driver acceptances, and trip completion
• Enable and manage delivery orders, restaurant/merchant confirmations, and courier assignments
• Enable flight searches, fare comparisons, and airline reservations
• Enable vacation rental searches, host/guest matching, booking management, and check-in coordination
• Provide navigation, route optimization, and estimated times of arrival
• Facilitate payments, refunds, driver/host payouts, and financial reconciliation
• Provide in-app communication tools between riders, drivers, customers, couriers, hosts, and guests
• Process promotional codes, referral credits, and loyalty rewards

4.2 Safety, Security, and Trust

• Verify the identity and eligibility of riders, drivers, delivery customers, couriers, hosts, and guests
• Conduct background checks for drivers, couriers, and other service providers
• Perform real-time identity verification (liveness checks) for drivers and hosts
• Detect, investigate, and prevent fraud, abuse, unauthorized access, and other harmful or illegal activity
• Enable safety features such as real-time trip sharing, emergency assistance, and incident reporting
• Handle insurance claims, accident investigations, and platform policy enforcement
• Monitor for violations of our Terms of Use, community guidelines, and applicable law

4.3 Communications

• Send transactional notifications about your account, trips, orders, bookings, and policy updates
• Provide customer support and respond to inquiries and disputes
• Send marketing communications about new features, promotions, and services (you may opt out at any time)
• Send surveys and solicit feedback to improve our Services
• Notify hosts and guests about upcoming reservations, check-in instructions, and changes

4.4 Legal, Compliance, and Business Purposes

• Comply with applicable laws, regulations, tax obligations, and governmental requests
• Comply with U.S. Department of Transportation (DOT) regulations governing air travel
• Comply with Transportation Security Administration (TSA) requirements for passenger name records and watchlist screening
• Comply with local short-term rental regulations, occupancy tax requirements, and licensing obligations
• Comply with Fair Credit Reporting Act (FCRA) requirements for background checks
• Comply with state-specific privacy laws (CCPA, CPRA, VCDPA, and others)
• Enforce our Terms of Use and other contractual agreements
• Defend against legal claims and protect the rights, safety, and property of Halen and our users

4.5 Flight Booking-Specific Uses

• Transmit passenger name records (PNR) and personally identifiable information (PII) to airlines, Global Distribution Systems (GDS), and relevant government bodies as required to complete bookings
• Submit Advance Passenger Information (API) and Passenger Name Records (PNR) to CBP/DHS for international flights, as required by law
• Process changes, cancellations, and refunds in accordance with airline fare rules
• Facilitate travel insurance claims and emergency travel assistance
• Store itinerary information for account trip history and customer support purposes

4.6 Vacation Rental Guest-Specific Uses

• Share necessary booking and identity information with hosts to complete reservations
• Process security deposits, damage claims, and resolution center disputes
• Verify guest eligibility based on host requirements and local regulations
• Facilitate check-in, access code delivery, and departure coordination

4.7 Vacation Rental Host-Specific Uses

• Verify host identity, property ownership or authorization, and regulatory compliance
• Process payout disbursements and maintain tax reporting records
• Provide performance analytics, occupancy metrics, and pricing recommendations
• Facilitate occupancy tax collection and remittance where Halen acts as a tax collection intermediary

4.8 Analytics and Product Improvement

• Conduct research, analytics, and business planning using de-identified or aggregated data where feasible
• Personalize search results, recommendations, and pricing based on usage history and preferences
• Test new features, improve platform performance, and diagnose technical issues
• Train and evaluate machine learning models used in matching, routing, fraud detection, and pricing

5. Cookies and Similar Tracking Technologies

Halen and our third-party partners use cookies, pixels, SDKs, device fingerprinting, and similar technologies across our websites and mobile applications. We use these technologies to:

• Maintain your session and keep you signed in
• Remember your preferences, language, and settings
• Understand how the Services are used and measure performance
• Personalize content, recommendations, and pricing
• Deliver targeted advertising and measure ad campaign effectiveness
• Detect fraud and maintain security

5.1 Categories of Cookies We Use

You can manage cookies through your browser settings, device settings, or our in-app cookie preferences center. Disabling certain cookies may affect the functionality of our Services.

6. How We Share Your Information

Halen does not sell your personal information for monetary consideration. We share information in the following circumstances:

6.1 Between Riders and Drivers

• Riders’ first name, rating, profile photo, pick-up and drop-off locations, and trip details are shared with their matched driver to complete a trip
• Drivers’ first name, vehicle make/model/color/plate, profile photo, rating, and real-time location are shared with matched riders
• Full addresses and contact details beyond masked in-app communication are not shared between riders and drivers without consent

6.2 Between Customers and Delivery Couriers

• Customer’s first name, delivery address, and order instructions are shared with their assigned courier
• Couriers’ first name, profile photo, real-time location, and vehicle information are shared with customers during active deliveries
• Specific dietary preferences or health-related order details are not shared with couriers beyond what is necessary to fulfill the order

6.3 With Merchants, Restaurants, and Retailers

• Order details, item selections, special instructions, and customer first name are shared with the merchant fulfilling a delivery order
• Customer dietary restrictions or allergen information provided in connection with an order are shared with the relevant merchant to fulfill the order
• Full customer addresses are provided to merchants only when operationally required

6.4 With Airlines and Flight Booking Partners

• Passenger Name Records (PNR), including full legal name, date of birth, passport details, and contact information, are transmitted to airlines and Global Distribution Systems (GDS) such as [Sabre / Amadeus / Travelport — INSERT APPLICABLE GDS] to complete bookings
• Advance Passenger Information (API), including passport and nationality data, is submitted to U.S. Customs and Border Protection (CBP) and foreign customs authorities for international travel, as required by law
• Frequent flyer numbers and loyalty program data are shared with airlines upon your request to earn or apply miles
• Travel insurance providers receive trip details and, where applicable, health or medical information necessary to process coverage or claims

6.5 Between Vacation Rental Guests and Hosts

• Upon confirmed booking, guests’ first name, profile photo, and booking dates are shared with the host
• Hosts may receive guest identity verification status (verified/not verified) but do not receive raw government ID documents
• Guests receive the property address, host contact information, and access instructions only after booking is confirmed and payment has been processed
• Guest reviews are published on host profiles; host reviews are published on guest profiles
• In the event of a damage claim, relevant evidence including photos and documentation may be shared between parties through our resolution center

6.6 With Vacation Rental Hosts (Host Information)

• Host personal information is shared with Halen’s payment processors to facilitate payouts
• Host tax identification information is shared with applicable tax authorities as required by law, and on IRS Form 1099-K where thresholds are met
• Local regulatory authorities may receive host listing information in jurisdictions where Halen is required to report short-term rental activity

6.7 With Service Providers and Business Partners

We share information with third parties that perform services on our behalf, including:

• Payment processing, fraud detection, and chargeback management
• Background check and identity verification providers
• Cloud hosting, data storage, and infrastructure providers
• Analytics, A/B testing, and performance monitoring tools
• Customer support platforms and ticketing systems
• Marketing, advertising, and email communication platforms
• Mapping, navigation, and geolocation service providers
• Insurance claims administrators

These service providers are authorized to use your information only as necessary to perform services for Halen or to comply with applicable law. They are bound by data processing agreements consistent with applicable privacy law.

6.8 For Legal Reasons

We may disclose personal information to law enforcement, regulatory agencies, or other third parties when we have a good-faith belief that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable government request
• Enforce our Terms of Use and other agreements
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of Halen, our users, or the public

6.9 Business Transfers

In connection with any merger, acquisition, financing, restructuring, bankruptcy, or sale of all or a portion of our business or assets, personal information may be shared or transferred as part of the transaction. We will notify you via email or prominent notice on our Services prior to information becoming subject to a different privacy policy as a result of such a transaction.

6.10 Selling and Sharing for Advertising

Halen does not sell personal information for money. To the extent Halen engages in cross-context behavioral advertising ("sharing" as defined under CCPA/CPRA), we will maintain a "Do Not Sell or Share My Personal Information" mechanism as described in Section 8.

7. Sensitive Personal Information

Certain categories of information we collect are considered "sensitive personal information" under applicable law, including the CCPA/CPRA. Halen collects and processes the following sensitive categories:

7.1 Biometric Data

Halen may collect facial images and conduct liveness checks for driver identity verification. In states with specific biometric privacy laws (including Illinois BIPA, Texas CUBI, and Washington's biometric law), Halen will:

• Provide a separate biometric data consent disclosure prior to collection
• Obtain explicit written consent before collecting biometric identifiers
• Not sell, lease, trade, or profit from biometric data
• Establish and maintain a publicly available retention schedule and destruction guidelines
• Destroy biometric data within the timeframes required by applicable law

7.2 Limiting Use of Sensitive Personal Information

Under CCPA/CPRA, you may have the right to limit Halen’s use of sensitive personal information to purposes strictly necessary to provide the Services. To exercise this right, see Section 8.

8. Your Privacy Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information. Halen will not discriminate against you for exercising any of these rights.

8.1 General Rights (All Users)

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete personal information
• Deletion: Request that we delete your personal information, subject to legal retention requirements
• Data Portability: Receive your personal information in a structured, commonly used format
• Opt-Out of Marketing: Unsubscribe from marketing emails or adjust notification preferences in your account

8.2 California Residents (CCPA / CPRA)

California residents have the following additional rights:

• Right to Know: Request the specific pieces and categories of personal information we have collected, used, disclosed, or sold about you in the past 12 months
• Right to Delete: Request deletion of personal information we collected from you (subject to exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out: Opt out of the sale or sharing of personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information to necessary purposes
• Right to Non-Discrimination: We will not deny service, charge different prices, or provide a different quality of service because you exercised your rights
• Shine the Light (Cal. Civil Code § 1798.83): California residents may request information about disclosures of personal information to third parties for direct marketing purposes

8.3 Other State-Specific Rights

Residents of the following states may have additional rights under their respective privacy laws:

• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Montana (MCDPA), Oregon (OCPA), and other states with comprehensive privacy laws: Rights to access, correct, delete, obtain a portable copy, opt out of targeted advertising, opt out of profiling with significant effects, and appeal decisions

To exercise state-specific rights, contact us using the methods in Section 14 and specify your state of residence.

8.4 How to Submit a Privacy Rights Request

• Online: Submit a request through our Privacy Portal at [INSERT URL]
• Email: Send your request to [email protected] with the subject line "Privacy Rights Request"
• Phone: Call [INSERT TOLL-FREE NUMBER] (available Monday–Friday, 9 AM–5 PM [TIME ZONE])

We will verify your identity before processing your request. Response times comply with applicable law (generally 45 days for CCPA, with a possible 45-day extension). We will not fulfill requests where we cannot verify your identity.

8.5 Do Not Sell or Share My Personal Information

To opt out of the sale or sharing of your personal information for targeted advertising purposes, you may:

• Click the "Do Not Sell or Share My Personal Information" link in the footer of our website
• Adjust your advertising preferences in app Settings > Privacy
• Submit a request via our Privacy Portal

We honor Global Privacy Control (GPC) signals as an opt-out of the sale or sharing of personal information for California residents.

9. Data Retention

Halen retains personal information for as long as necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and applicable law:

When personal information is no longer needed, Halen will delete, de-identify, or aggregate it, subject to legal and operational requirements.

10. Children’s Privacy

Halen’s Services are not directed to children under the age of 18. Our Terms of Use require all users to be at least 18 years of age to create an account. We do not knowingly collect personal information from individuals under 18.

However, we recognize that in certain contexts — particularly vacation rental reservations — minors may be listed as accompanying guests. In such cases:

• The account holder (who must be 18 or older) bears responsibility for all information provided about minor guests
• We collect only the minimum information necessary about minors to fulfill the service (e.g., number of guests, ages for occupancy purposes)
• Information about minors is not used for marketing, profiling, or advertising purposes
• We do not knowingly use information about minors for behavioral advertising

If you believe a person under 18 has provided personal information to Halen without parental consent, please contact us at [email protected]. We will take prompt steps to delete such information.

11. Data Security

Halen employs technical, administrative, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

11.1 Technical Safeguards

• Encryption of personal information in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
• Tokenization of payment card data; raw card numbers are not stored on Halen systems
• Encryption of sensitive fields including passport numbers, Social Security Numbers, and government IDs
• Secure key management practices using industry-standard key management systems
• Multi-factor authentication for internal systems and user accounts
• Regular penetration testing and vulnerability assessments
• Real-time fraud detection and anomaly monitoring systems

11.2 Administrative Safeguards

• Access controls limiting employee access to personal information on a need-to-know basis
• Background checks for employees with access to sensitive data
• Annual privacy and security training for all employees
• Data processing agreements with all vendors and service providers
• Incident response procedures and breach notification protocols compliant with applicable law

11.3 Limitations

No security system is impenetrable, and we cannot guarantee absolute security of your information. In the event of a data breach that requires notification under applicable law, we will notify affected users and applicable regulators in accordance with legal requirements.

12. International Data Transfers

Halen is based in the United States. Our Services are primarily intended for users in the United States; however, because we offer flight booking for international travel and vacation rental properties that may be located outside the United States, your personal information may be transferred to, stored, and processed in countries other than your country of residence.

12.1 Transfers to the United States

If you access our Services from outside the United States, your information will be transferred to and processed in the United States, which may have data protection standards different from those of your jurisdiction.

12.2 International Flight Booking Data

For international flight bookings, passenger data (including passport information) is required to be transmitted to foreign airlines, Global Distribution Systems, and government authorities in destination and transit countries as required by law. These transfers are mandatory and cannot be avoided for international travel.

12.3 Safeguards for International Transfers

Where required by applicable law, Halen implements appropriate safeguards for international transfers of personal data, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission, for transfers involving EU/EEA personal data
• Data processing agreements with international service providers
• Adequacy decisions where applicable

12.4 GDPR Applicability

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland and access our Services (for example, booking an international flight or listing/booking a vacation rental), the General Data Protection Regulation (GDPR) or applicable national implementations may apply to our processing of your personal data. In such cases, please contact us at [email protected] for information about your GDPR rights and applicable data transfer mechanisms. [LEGAL REVIEW NOTE: Confirm whether a EU Data Protection Representative appointment is required.]

13. Third-Party Links, Integrations, and Services

Our Services may contain links to, or integrate with, third-party websites, applications, or services that are not operated or controlled by Halen. Examples include:

• Airline websites and booking confirmation pages
• Vacation rental property management system integrations
• Mapping and navigation providers (e.g., Google Maps)
• Payment processors (e.g., Stripe, Braintree)
• Social media login providers
• Review aggregators

Halen is not responsible for the privacy practices of these third parties. Their use of your information is governed by their own privacy policies, which we encourage you to review before engaging with those services. Halen does not control and is not responsible for the content, privacy policies, or practices of third-party websites or services.

14. Changes to This Privacy Policy

Halen may update this Privacy Policy periodically to reflect changes in our practices, Services, legal obligations, or for other operational, legal, or regulatory reasons. When we make material changes:

• We will revise the "Last Updated" date at the top of this Policy
• For material changes, we will notify you via email to the address associated with your account, in-app notification, or prominent banner on our website at least 30 days before the changes take effect
• For significant changes affecting your rights, we may require affirmative re-consent before you continue using affected Services

Your continued use of the Services after the updated Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree with the updated policy, you should stop using the Services and may request deletion of your account.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

END OF DOCUMENT

Halen Technologies Inc. • 1007 N. Market Street, STE G20, Wilmington, DE 19801 • [email protected]