Privacy Policy of CARRIVO GmbH

Effective as of: 14 July 2026

CARRIVO (“we”, “us”, “our”) is committed to protecting the privacy of visitors (“you”, “your”) to our website www.carrivo.com (the “Website”) and all related services.

This Privacy Policy explains how we collect, use, store and protect personal data – in accordance with the General Data Protection Regulation (GDPR) and the applicable German data protection laws.

By using our Website, you agree to the practices described in this Privacy Policy.

1. Controller and Contact Details

Controller: Carrivo GmbH
Email: hallo@carrivo.com
Telephone: +49 421 49188630
Address: Kommodore-Ziegenbein-Allee 3, 28217 Bremen
Commercial Register: HRB 41855, Local Court (Amtsgericht) Bremen
Registered Office: Bremen, Germany

You may exercise your rights under the GDPR, submit inquiries or report data protection concerns via the email address provided above.

2. Collection of Personal Data

CARRIVO collects personal data only if you voluntarily provide it to us via our website forms or subscribe to updates.

Collected data may in particular include:

• first name
• last name
• email address

We do not collect financial, sensitive or technical data beyond what is necessary for communication purposes.

Depending on how you use our Website and services, the following data may also be collected:

• telephone number
• payment data (where required for paid services)
• technical data (e.g. IP address, browser type, device information and usage data), collected via cookies or analytics tools

These data are collected and used solely with your explicit consent in order to:

• respond to your inquiries
• provide information about our services
• send marketing communications or updates (only where consent has been given)
• conclude and perform a contract with you

3. Use of Personal Data

CARRIVO uses personal data solely for legitimate business and communication purposes.

Purposes of processing:

Marketing communication:

• Sending newsletters, updates and promotional materials to users who have provided their consent
• Analysing the effectiveness of communication

Customer and service communication:

• Processing inquiries submitted via our Website or the waiting list form
• Providing information about CARRIVO and our car subscription offering

Internal analysis:

• Monitoring website performance and optimising the user experience
• Evaluating the effectiveness of our communication channels (only with user consent)

Legal and contractual obligations:

• Initiation and performance of the contract
• Compliance with statutory retention obligations or other legal requirements

4. Purpose and Legal Bases for Processing

CARRIVO processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) as well as the applicable German data protection laws.

Purpose of Processing	Legal Basis under the GDPR
Sending newsletters or promotional materials (only with opt-in)	Consent – Art. 6(1)(a)
Responding to inquiries and providing requested information Contractual or pre-contractual measures	Initiation and performance of the contract – Art. 6(1)(b)
Internal analysis or website optimisation (e.g. statistical evaluation with consent) Credit check GPS tracking of the vehicle	Legitimate interest – Art. 6(1)(f)
Fulfilment of legal or regulatory obligations (e.g. statutory retention obligations)	Legal obligation – Art. 6(1)(c)

CARRIVO ensures that all data are processed lawfully, fairly and transparently – exclusively for the purposes stated in this Privacy Policy.

5. Consent and Opt-In Procedures

Communication Consent

If you sign up for updates, fill out a form or use the booking process, you can voluntarily choose whether and through which communication channels we may contact you.

• Depending on your selection, we may contact you via email, WhatsApp or telephone. Such communication may include assistance during the booking process (for example, if you do not complete your booking), information about your Carrivo car subscription, as well as, where covered by your consent, suitable vehicles, new offers, promotions and benefits.
• Your consent is voluntary. You may withdraw your consent at any time with effect for the future or change your selection. A withdrawal can in particular be made by email to hallo@carrivo.com. Upon receipt, all corresponding communications will be discontinued.
• We store your consent together with timestamps and verification data in order to document whether, when and for which communication channels you have provided your consent.
• We use a double opt-in procedure for email communications. After registration, you will receive an email requesting confirmation of your registration. Your email address will only be used for corresponding communications after this confirmation has been completed.

Cookie Consent

Our Website uses cookies to improve functionality and user experience.

• Necessary cookies are required for the operation of the Website and are always active.
• Non-essential cookies (e.g. analytics or marketing cookies) are used only after explicit consent via the cookie banner or cookie settings.
• You may adjust or withdraw your consent at any time via the cookie manager available on the Website.

Further details can be found in the CARRIVO Cookie Policy.

6. Identity and Creditworthiness Checks

To prevent fraud and reduce the risk of payment defaults, we conduct identity and creditworthiness checks.

For the identity verification, we use the service Veriff as our processor (Auftragsverarbeiter). Further information about how Veriff processes your personal data can be found at: https://www.veriff.com/privacy-notice.

For the creditworthiness check, we use the service finAPI, which performs the credit assessment as an independent controller on the basis of a user agreement concluded with you. Information about the processing of your personal data during the credit assessment can be found at: https://sandbox.finapi.io/dpp?version=V2.0.

7. Telematics Data

Vehicles provided by CARRIVO may be equipped with telematics systems that collect and transmit data such as location (GPS data), mileage, technical status information or system notifications. These data are processed exclusively for the following purposes:

• fulfilment and monitoring of the contractually agreed use of the vehicle (e.g. determination of driven kilometres, billing, contract duration),
• performance of maintenance, safety and service measures,
• detection and prevention of misuse (e.g. leaving the permitted driving area or presence in risk zones),
• vehicle location in case of loss, theft or other security-relevant events.

8. Retention of Personal Data

Personal data are stored only for as long as necessary for the respective purposes or as required by statutory or contractual retention obligations. Retention periods include in particular:

• Marketing contacts
  Until withdrawal of consent or a maximum of 3 years from the time of collection.
• Service inquiries
  Until the inquiry has been fully processed, plus 5 years for evidentiary purposes.
• Analytics data
  Aggregated or anonymised data may be stored permanently for analytical purposes.
• Payment and transaction data
  Up to 7 years in accordance with tax and commercial law requirements.
• Telematics data
  Up to 3 months after the end of the contract.

After the applicable retention periods have expired, the data will be securely deleted or anonymised.

9. Data Security

We implement technical and organisational measures to ensure the confidentiality, integrity and availability of personal data. These measures include, in particular:

• encrypted data storage and SSL/TLS-secured communication
• role-based access management (access only where authorised and necessary)
• regular reviews, audits and security protocols

Notification of Data Breaches

In the event of a data breach, we will notify the competent supervisory authority within 72 hours and inform affected individuals if a high risk to their rights and freedoms exists – in accordance with Art. 33 and 34 GDPR.

10. Rights of Data Subjects

Under the GDPR, you have the following rights:

• access to your stored personal data
• rectification of inaccurate data
• erasure (“right to be forgotten”)
• restriction of processing
• withdrawal of your consent
• objection to direct marketing
• data portability (provision of your data in a machine-readable format)
• the right to lodge a complaint with a data protection supervisory authority

For Germany:

The State Commissioner for Data Protection and Freedom of Information of the Hansestadt Bremen

Arndtstraße 1, 27570 Bremerhaven, Germany
https://www.datenschutz.bremen.de

Requests may be sent to hallo@carrivo.com and will be processed within 30 days.

11. Cookies and Third-Party Tools

Our Website uses a cookie consent manager that allows you to manage your preferences and to consent to or reject the use of analytics, marketing or functional cookies. We may share personal data with trusted service providers acting on our behalf (processors), including:

• Hosting and infrastructure providers
  Data processing generally takes place within the European Union. If, in individual cases, a transfer to a third country (outside the EEA) is required, CARRIVO ensures that an adequate level of data protection in accordance with Art. 46 GDPR is guaranteed by concluding EU Standard Contractual Clauses.
• Analytics services
  (e.g. Webflow Analytics or similar tools) Analytics are carried out exclusively using privacy-compliant tools in which IP addresses are anonymised or processed only in pseudonymised form. Direct attribution to a specific individual is excluded.
• Payment service providers
  (e.g. Stripe, including Stripe Radar) We use Stripe to process payments. As part of payment processing and fraud prevention, Stripe processes personal data, including information about devices that connect to Stripe's services and how those services are used. Stripe uses this information to provide and improve its services and to detect and prevent fraudulent activity. Further information about how Stripe processes personal data can be found in Stripe's Privacy Policy: https://stripe.com/privacy.
• Email marketing platforms
  (e.g. Mailchimp)
• Communication services
  (e.g. WhatsApp Business). Where we use WhatsApp Business to communicate with you, personal data is processed by WhatsApp Ireland Limited. As part of this communication, personal data (in particular your telephone number, communication data and connection data) may also be transferred to companies within the Meta Group. It cannot be excluded that personal data may be processed outside the European Economic Area (EEA). In such cases, Carrivo ensures that appropriate safeguards pursuant to Art. 46 GDPR, in particular the EU Standard Contractual Clauses, are in place. Further information on how WhatsApp processes personal data can be found in WhatsApp's Privacy Policy: https://www.whatsapp.com/legal/privacy-policy-eea.

Where the above service providers act as data processors on our behalf, they are contractually required to process personal data solely in accordance with our instructions and in compliance with the GDPR.

Further information on cookies can be found in our Cookie Policy.

12. International Data Transfers

Personal data are generally processed and stored within the European Economic Area (EEA).

If a transfer to third countries becomes necessary, CARRIVO ensures that such transfers comply with the requirements of the GDPR (e.g. through EU Standard Contractual Clauses or equivalent safeguards).

13. Minors

Our Website is not intended for persons under the age of 16. CARRIVO does not knowingly collect personal data from minors.

14. Changes to this Privacy Policy

CARRIVO may update this Privacy Policy to reflect changes to our services, technologies or legal requirements.

Changes may be announced through:

• notice banners on the Website
• email notifications to registered users
• version history available on the Website

If significant changes are made that affect your consent, such consent will be obtained again in accordance with the requirements of the GDPR.

The current version of this Privacy Policy is always available on our website.