Privacy Policy

D1 Express operates an on-demand motorcycle delivery marketplace in the Lao PDR (initial pilot: Vientiane). Our Platform connects three kinds of people:

• Senders — people who request that an item be picked up and delivered.
• Riders — independent delivery riders who accept, carry out, and complete deliveries.
• Recipients — people who receive the delivered item.

This Privacy Policy explains what information we collect when you use the D1 Express applications, websites, and related services (together, the "Platform"), why we collect it, how we use it, and with whom we share it. It applies to senders, riders, recipients, and visitors to the Platform.

Important — the nature of a delivery service. Delivery cannot be completed without exchanging certain information between the sender, the rider, and the recipient. For example, the rider must be able to reach the pickup and drop-off locations and contact the parties, and the recipient's name, phone number, and address are needed to complete the handover. This Policy does not claim that your information is never shared. Instead, it explains the sharing that is necessary to provide the service, and the limits we place on it. See Section 5.

This Policy does not cover the independent privacy practices of third parties (for example, a payment provider's own handling of your data, or a maps provider). Where relevant, those third parties act under their own terms and notices.

We collect the following categories of information. Not every field applies to every user; what we collect depends on your role (sender, rider, or recipient) and how you use the Platform.

2.1 Account information - Name. - Phone number. - Email address (where provided). - Password and authentication data. We do not store your password in readable form; authentication is handled through secured credentials and/or our authentication provider. - Account role and status (for example, sender or rider), and account settings and preferences, including display language.

2.2 Sender information - Information you provide when requesting a delivery, including pickup details and any notes or instructions for the rider.

2.3 Recipient information - Recipient name. - Recipient phone number. - Recipient delivery address.

This information is typically provided by the sender in order to arrange the delivery. If you are a recipient and did not provide this information yourself, Section 11 and Section 14 explain how you can contact us about it.

2.4 Delivery addresses and delivery details - Pickup and drop-off addresses. - Delivery contents description, size/handling notes, and status of the delivery (for example, requested, accepted, picked up, delivered), stored as canonical status codes rather than translated text.

2.5 Location and GPS data - Rider location data (GPS) collected from the rider's device. See Section 4 for detailed, implementation-specific disclosure about when this is collected and who can see it. - Location associated with pickup and drop-off addresses.

2.6 Rider telemetry - Operational data from a rider's use of the Platform while online, which may include location trail during an active delivery, timestamps for delivery events, availability/online status, and device signals used for dispatch, matching, tracking, and safety.

2.7 Payment records - Records of payments and settlement, including prepaid (in-app) payment records where enabled, and cash / cash-on-delivery (COD) reconciliation records (amounts collected, amounts owed/settled, commission). - We do not store full payment-card numbers or equivalent sensitive credentials on the Platform. Where card or wallet payments are enabled, they are handled by a payment provider (see Sections 6 and 7).

2.8 Device and technical information (where collected) - Device and app information such as device/app version, operating-system information, language, and technical identifiers, where collected. [LEGAL COUNSEL REVIEW REQUIRED — device data scope] - Log data generated when you use the Platform (for example, event timestamps and error logs).

2.9 Support messages - The content of support tickets and messages you send to us, and our responses, together with related metadata (for example, the time of the message and the account it relates to).

2.10 Legal acceptance records - Records that you accepted a legal document (for example, terms of service or this Privacy Policy). See Section 8 for the specific fields.

We process the information described in Section 2 for the following purposes:

1. To provide the delivery service — to create and manage deliveries; to match senders with riders; to enable pickup, transport, and handover; and to allow the parties to a delivery to coordinate. 2. To operate accounts — to register you, authenticate you, maintain your account, and set your language and preferences. 3. Dispatch and matching — to assign deliveries to available, eligible riders. 4. Live tracking and coordination — to show delivery progress and, during an active delivery, the rider's position (see Section 4). 5. Safety and integrity — to help protect the safety of riders, senders, recipients, and the public; to investigate incidents, disputes, fraud, and misuse; and to enforce our terms. 6. Payments and settlement — to process prepaid payments where enabled, to reconcile cash/COD collections, and to calculate and settle commission and rider earnings. 7. Customer support — to respond to your questions, tickets, and requests. 8. Service improvement and reliability — to monitor, maintain, debug, and improve the Platform. 9. Legal, compliance, and record-keeping — to keep records of legal acceptances, to comply with obligations that apply to us, and to establish, exercise, or defend legal claims. 10. Communications — to send you service-related messages about your deliveries, account, and support requests. [LEGAL COUNSEL REVIEW REQUIRED — marketing/consent]

The lawful basis for each purpose under applicable Lao law is to be confirmed by counsel. [LEGAL COUNSEL REVIEW REQUIRED — lawful basis]

Location data is central to a delivery service, and we want to be clear and specific about how we handle it. This section is intended to match how the Platform actually behaves. We do not use this Policy to conceal or understate the collection of location data.

4.1 Rider location — collected only while online/active - We collect a rider's device location (GPS) only while the rider is online / active on the Platform, and in particular while the rider is available for or carrying out a delivery. - We do not collect a rider's location when the rider is offline / not active on the Platform.

4.2 How rider location is used Rider location is used to: - Dispatch and matching — to find and assign nearby, eligible riders to a delivery; - Live tracking — to show delivery progress to the parties of an active delivery; and - Safety — to help protect riders and users and to investigate incidents and disputes.

4.3 What the customer can see - During an active delivery, the customer (the sender, and where applicable the recipient) can see the assigned rider's position on a map so that they can follow the delivery's progress. - Outside of an active delivery, the customer cannot see the rider's location through the Platform. - Whether the customer sees the rider's precise position or only an approximate position, and the exact behavior at each stage of a delivery, is to be confirmed against the implementation. [LEGAL COUNSEL REVIEW REQUIRED — location retention/precision]

4.4 Retention of location data - How long location trails and telemetry are retained, and in what form (for example, whether they are reduced, aggregated, or deleted after a period), is to be confirmed against the implementation and applicable law. [LEGAL COUNSEL REVIEW REQUIRED — location retention/precision]

4.5 Pickup and drop-off locations - Pickup and drop-off addresses and their associated locations are processed to enable and complete the delivery, and are shared with the assigned rider as described in Section 5.

Completing a delivery necessarily involves sharing certain information between the sender, the rider, and the recipient. We share only what is needed to arrange, carry out, and complete a delivery, and we limit access based on role and the active delivery.

• To the rider assigned to a delivery, we make available the information needed to perform it — for example, the pickup and drop-off addresses and locations, the recipient's name and phone number, contact details for coordination, and any handling notes.
• To the sender, we make available the information needed to track and coordinate the delivery — for example, delivery status, and, during an active delivery, the assigned rider's position and contact means for coordination.
• To the recipient, where applicable, we make available information needed to receive the delivery — for example, delivery status and coordination with the rider.

Access to contact and location information for a delivery is limited to the parties of that delivery and to the period in which it is operationally needed. We do not sell your personal information. [LEGAL COUNSEL REVIEW REQUIRED — no-sale statement]

We may also share information: - with service providers acting on our behalf (Section 6); - with payment providers where in-app payment is enabled (Sections 6 and 7); - where required to comply with law, respond to lawful requests from competent authorities, or protect the rights, safety, and property of users, the public, or D1 Express; and - in connection with a business transfer (for example, a merger, acquisition, or reorganization), subject to appropriate protections. [LEGAL COUNSEL REVIEW REQUIRED — disclosures to authorities / business transfer]

We use third parties to provide the Platform. These providers process information on our behalf and under our instructions, and are permitted to use it only to provide their services to us. We name categories of provider rather than specific vendors here; the current list of providers is to be maintained by us and confirmed by counsel. [TODO: MAINTAIN CURRENT LIST OF SERVICE PROVIDERS]

Categories include: - Hosting and infrastructure — cloud hosting, database, storage, and backend services that run the Platform. - Maps and routing — map, geocoding, routing, and map-tile services used to show locations, plan routes, and display tracking. - Payment providers — payment processing and settlement services, where in-app payment is enabled (see Section 7). - Authentication — services used to register and authenticate users and secure accounts. - Communications — services used to deliver service messages and notifications (for example, push notifications). [LEGAL COUNSEL REVIEW REQUIRED — communications/notification providers] - Support and operations — tools used to handle support tickets and operate the service.

Some providers may process or store information outside the Lao PDR. Any cross-border transfer of personal information will be handled in accordance with applicable law. [LEGAL COUNSEL REVIEW REQUIRED — cross-border transfer]

• Prepaid (in-app) payments. Where in-app payment is enabled, payment is processed by a third-party payment provider. We keep payment records (for example, that a payment was made, the amount, the delivery it relates to, and its status), but we do not store full card numbers or equivalent sensitive payment credentials on the Platform.
• Cash / cash-on-delivery (COD). For cash deliveries, we keep reconciliation records — for example, the amount to be collected, the amount collected, commission, and amounts owed or settled between the rider and D1 Express.
• Commission and settlement. We process payment and settlement records to calculate commission and rider earnings and to reconcile accounts.

Payment providers handle certain payment information under their own terms and privacy notices. [LEGAL COUNSEL REVIEW REQUIRED — payment provider terms / financial record-keeping obligations]

When you accept a legal document on the Platform (for example, terms of service or this Privacy Policy), we keep a record so that we can show what you agreed to and when. Each acceptance record may include:

• the document type (for example, `PRIVACY_POLICY`);
• the document version (for example, `1.0`);
• the timestamp of acceptance;
• the display language shown to you at the time of acceptance;
• the method of acceptance (for example, how and where the acceptance was recorded); and
• optionally, the IP address and user-agent at the time of acceptance.

We collect the IP address and user-agent as evidence fields only if doing so is disclosed to you and permitted under applicable law; whether these fields are collected is to be confirmed. [LEGAL COUNSEL REVIEW REQUIRED — evidence fields]

These records are kept to evidence your acceptance and to meet record-keeping needs. Retention is addressed in Section 9.

We keep personal information for as long as needed for the purposes described in this Policy — for example, to provide the service, to keep delivery and payment records, to resolve disputes, to evidence legal acceptances, and to comply with obligations that apply to us — and then delete or de-identify it.

Specific retention periods for each category of data (including account data, delivery records, location/telemetry data, payment and reconciliation records, support messages, and legal acceptance records) are to be defined and confirmed against applicable law and our record-keeping needs. [LEGAL COUNSEL REVIEW REQUIRED — data retention]

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and loss. These measures include, for example:

• access controls that limit who can see delivery contact and location information, generally to the parties of a delivery and authorized personnel;
• protection of authentication credentials (we do not store passwords in readable form);
• server-side handling of sensitive operations such as pricing, commission, and delivery state changes; and
• keeping server-only secrets (for example, privileged service keys) out of client applications.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our incident-response and breach-notification approach is to be confirmed against applicable law. [LEGAL COUNSEL REVIEW REQUIRED — breach notification]

Subject to, and to the extent provided by, applicable Lao PDR law, you may have rights in relation to your personal information — which may include the ability to access, correct, update, or request deletion of certain information, to object to or restrict certain processing, or to withdraw a consent you have given.

The specific rights available, any conditions or exceptions, and how they apply to senders, riders, and recipients (including recipients whose details were provided by a sender) are to be confirmed by counsel. [LEGAL COUNSEL REVIEW REQUIRED — Lao data rights]

To make a request, contact us as described in Section 14. We may need to verify your identity before acting on a request, and some information may be retained where we are required or permitted to keep it (see Section 9).

The Platform is intended for use by adults and is not directed to children. The minimum age to use the Platform and any related requirements are to be confirmed against applicable law. [LEGAL COUNSEL REVIEW REQUIRED — minimum age / children] If we learn that we have collected personal information from a person below the applicable minimum age without appropriate authorization, we will take appropriate steps consistent with applicable law.

We may update this Policy from time to time. When we make a material change, we will update the version and effective date above and, where appropriate, notify you and/or ask you to accept the updated Policy. Your continued use of the Platform after an update takes effect is subject to the updated Policy, as permitted by applicable law. Prior acceptances are recorded as described in Section 8.

If you have questions about this Policy, or want to make a request about your personal information, contact us:

• Operator: [TODO: LEGAL ENTITY NAME]
• Address: [TODO: REGISTERED ADDRESS]
• Email: [TODO: PRIVACY CONTACT EMAIL]
• Phone: [TODO: CONTACT PHONE]
• In-app: through the support / help feature in the D1 Express application.

We will respond within a reasonable time and in accordance with applicable law. [LEGAL COUNSEL REVIEW REQUIRED — response timeframe / data protection contact or officer]