UPDASH PRIVACY POLICY

UpDash is operated by Updash Technologies Ltd, a company incorporated in the Republic of Mauritius ("UpDash", "we", "us", or "our"). Updash Technologies Ltd is the data controller when it decides why and how personal data is processed through the UpDash website, applications, ordering platform, and related services (the "Platform").

This Privacy Policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights available to you under the Data Protection Act 2017 of Mauritius ("DPA").

Privacy and Data Protection Officer enquiries: admin@updash.mu

Depending on how you use UpDash, we may collect:

• Account and contact data: name, email address, telephone number, account identifier, profile information, and sign-in records;
• Order data: items ordered, Merchant, order value, time, status, delivery or pickup details, cancellations, complaints, and refund records;
• Delivery data: delivery address, instructions, contact information, delivery status, and communications needed to complete the delivery;
• Wallet data: UpDash Credit balances, Credits used, adjustments, and refund credits;
• Support data: messages, feedback, reviews, complaint details, and photographs or documents you choose to provide;
• Technical and security data: IP address, device and browser information, session and login information, application version, security events, diagnostic data, and basic performance information; and
• Merchant and Driver data: information needed to manage participation, verify eligibility, fulfil orders, communicate, maintain safety, and meet legal obligations.

At launch, customer orders are paid at delivery or pickup. UpDash may record the order total, payment status, and related Wallet or refund entries, but does not need to collect or store your complete payment-card or bank-account details for those orders.

UpDash does not continuously track a customer's live location. If you choose to allow device location, it may be used to help you select or confirm a delivery address. Drivers' location data may be processed during active dispatch and delivery operations, as explained in the Driver App Privacy Policy.

We collect personal data:

• Directly from you when you create an account, place an order, choose an address, contact support, submit a complaint, or otherwise use the Platform;
• Automatically from your browser, device, or application when needed for sessions, security, diagnostics, fraud prevention, and service performance;
• From Merchants and Drivers when needed to accept, prepare, deliver, or resolve an order; and
• From service providers or public authorities where the information is lawfully provided and relevant to operating or protecting the Platform.

Where we rely on legitimate interests, we consider whether those interests are overridden by your rights. Where processing requires consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.

We do not sell personal data.

We may share only the information reasonably needed with:

• Merchants, so they can accept, prepare, fulfil, and resolve an order;
• Drivers, so they can collect and deliver an order, contact you where necessary, and deal with safety or delivery issues;
• Technology providers, including hosting, communications, mapping, storage, security, support, and Platform-maintenance providers;
• Professional advisers, where legal, accounting, audit, insurance, or other advice is needed;
• Authorities, courts, or regulators where disclosure is required or permitted by law; and
• A business successor, where information is relevant to a genuine merger, acquisition, restructuring, or sale and appropriate safeguards apply.

Merchants, Drivers, and service providers must use personal data only for authorised purposes and in accordance with their legal and contractual responsibilities.

UpDash may use automated tools together with manual review to identify suspicious orders, repeated refund abuse, account misuse, security threats, or other harmful activity. Relevant information may include order history, complaints, Wallet activity, account access, device information, and patterns suggesting fraud.

UpDash may request additional verification or restrict an account while a serious concern is reviewed. Where the DPA gives you rights relating to a decision based solely on automated processing that has a legal or similarly significant effect, UpDash will provide the safeguards required by law. You may contact us to request review of a restriction.

Some technology providers may process personal data outside Mauritius. Where this happens, UpDash will use an appropriate transfer mechanism and reasonable contractual, organisational, or technical safeguards required by the DPA.

UpDash keeps personal data only for as long as reasonably necessary for the purpose for which it was collected or for a longer period required or permitted by law.

Retention depends on the type and sensitivity of the data, the length of your relationship with UpDash, tax and accounting rules, legal limitation periods, fraud and security needs, and whether information is required for a complaint or legal claim.

When personal data is no longer required, UpDash will take reasonable steps to delete, destroy, or anonymise it. A deletion request does not require UpDash to erase information that must lawfully be retained.

UpDash uses appropriate technical and organisational measures designed to protect personal data. These may include access controls, authentication, encrypted transmission, monitoring, backups, testing, and restrictions on employee and contractor access.

No electronic service can guarantee absolute security. If UpDash becomes aware of a personal data breach, it will investigate and respond in accordance with the DPA, including notifying the Data Protection Commissioner or affected people where legally required.

Subject to the conditions and exceptions in the DPA, you may have the right to:

• Ask whether UpDash processes personal data about you and request access;
• Correct inaccurate or incomplete personal data;
• Request erasure or restriction of processing in qualifying circumstances;
• Object to certain processing, including direct marketing;
• Withdraw consent where processing relies on consent;
• Request applicable information about international transfers;
• Exercise applicable rights concerning automated decisions; and
• Lodge a complaint with the Mauritius Data Protection Commissioner.

To exercise a right, email admin@updash.mu. UpDash may request information reasonably needed to verify your identity and understand the request.

The Platform uses cookies and similar storage where needed for sign-in, session continuity, security, preferences, and core functionality. It may also collect limited technical performance information to diagnose problems and improve reliability.

UpDash does not currently run active customer direct-marketing campaigns through the Platform. If optional marketing, non-essential analytics, or similar tracking is introduced, this Policy and the relevant notice will be updated and consent will be requested where required by law.

Essential order, delivery, account, refund, and security communications are service messages rather than marketing and may be sent where needed to provide or protect the service.

The customer ordering service is intended for adults. A person under 18 should use it only with the permission and supervision of a parent or legal guardian. If UpDash learns that children's personal data has been collected contrary to applicable law, it will take appropriate steps to address the matter.

The Platform may link to an independent third-party website or service. If that third party decides how it uses personal data, its own privacy notice applies. UpDash is not responsible for the independent privacy practices of third parties.

UpDash may update this Policy to reflect changes in the Platform, data practices, service providers, or law. The updated version and effective date will be published on the Platform. Where a material change significantly affects how personal data is processed, UpDash will provide additional notice or obtain consent where required by law.

Questions, requests, or complaints about personal data may be sent to:

Updash Technologies Ltd

Data Protection Officer

Republic of Mauritius

Email: admin@updash.mu Website: https://www.updash.mu

If you believe your personal data has been handled unlawfully, you may contact UpDash first so that the concern can be investigated. You may also lodge a complaint with the Data Protection Commissioner or Data Protection Office of Mauritius. Nothing in this Policy limits a right available under the DPA or other applicable law.