PRIVACY POLICY

(LAKBAI)

This Privacy Policy (the “Policy”) describes how LBSD Mobility OPC, doing business under the name and style of LAKBAI TRANSPORT SOLUTIONS (“Lakbai,” “we,” “us,” or “our”), a One Person Corporation duly organized and existing under the laws of the Republic of the Philippines, collects, uses, stores, shares, and otherwise processes the personal data of individuals (“Users,” “you,” or “your”) who access or use the Lakbai platform, services, website, and mobile applications (collectively, the “Platform”).

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”), and its Implementing Rules and Regulations (“IRR”), as administered and enforced by the National Privacy Commission (“NPC”). It adopts the principles of transparency, legitimate purpose, and proportionality mandated by the DPA.

By registering for, accessing, or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of, and is incorporated by reference into, Lakbai's Terms of Service.

Lakbai reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, NPC issuances, Platform features, or data processing practices. Amended versions of this Policy shall be posted on the Platform with the revised effective date. Material changes shall be communicated to registered Users through in-app notification or email prior to taking effect.

Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgment of and agreement to the revised Policy. If you do not agree with the amended Policy, you must cease using the Platform and may request account closure pursuant to Section 10 of this Policy.

Section 1

Identity of the Personal Information Controller

Pursuant to Section 3(h) of the DPA, Lakbai acts as the Personal Information Controller ("PIC") with respect to all personal data collected through the Platform. The following information identifies Lakbai as your PIC:

Legal Name:  LBSD Mobility OPC

Trade Name:  Lakbai Transport Solutions

Business Nature:  Peer-to-peer car rental marketplace (asset-light technology platform)

Initial Service Area:  Cavite and South Metro Manila, Republic of the Philippines

Data Protection Officer:  Tentative (Legal)

DPO Email:  

DPO Address:  _____________

NPC Registration Status:  __________

Section 2

Scope of this Policy

This Policy applies to:

• All registered Users of the Platform, including Hosts and Renters;
• Visitors to Lakbai’s website or mobile applications who have not yet completed registration; and
• The Platform may also process limited personal data pertaining to individuals who are not registered Users, where such data is submitted by a User in connection with a booking or transaction. This is limited to identified categories including authorized additional drivers and vehicle co-owners or co-registrants. Users who submit personal data of third parties represent that they are authorized to do so and that such individuals have been informed of this Policy. Lakbai shall, where practicable, notify such individuals of the processing of their personal data at the next practicable opportunity.

This Policy does not apply to third-party websites, applications, or services that may be linked to or integrated with the Platform. Lakbai is not responsible for the privacy practices of such third parties, and Users are encouraged to review the relevant privacy policies of those third parties independently.

Section 3

Personal Data We Collect

Lakbai collects personal data that is necessary, adequate, and relevant to the purposes described in this Policy. We collect personal data from three sources: information you give us directly; information automatically collected from your use of the Platform; and information from third-party sources.

3.1. Information You Give Us Directly

• Identity and Contact Information (All Users)

• Full legal name as appearing on a valid government-issued identification document;
• Date of birth and age verification data;
• Government-issued identification card details (e.g., PhilSys ID, Philippine passport, LTO driver's license, SSS/GSIS card), including identification type, number, and expiry date;
• Valid and active email address;
• Valid Philippine mobile phone number;
• Profile photograph, if uploaded; 
• A selfie photograph taken while holding a valid government-issued identification document, collected as part of Lakbai's identity verification process; and
• Such other information as Lakbai may require from time to time, including nature and source of income, subject to applicable law.

• Renter-Specific Data

• Philippine driver's license number, license type (non-Student Permit), expiry date, and a clear photograph of the license; and
• Driver's license verification data.

• Host-Specific Data

Collected for each vehicle listed on the Platform:

• Official Receipt and Certificate of Registration (OR/CR) details, including plate number, engine number, chassis number, and current registration validity;
• Proof of Compulsory Third Party Liability (CTPL) insurance;
• Proof of comprehensive insurance coverage, including policy number and validity dates; and
• Vehicle photographs (exterior: front, rear, driver's and passenger's sides; interior: front and rear seats, dashboard; odometer reading and fuel gauge).

• Transaction and Booking Data

• Booking requests, confirmations, modifications, and cancellation records;
• Security deposit amounts and disposition records;
• Payment information (processed by Lakbai's third-party payment processor; Lakbai does not directly store full payment card numbers);
• Platform Service Fee and Trip Fee records;
• Pre-trip and post-trip vehicle condition documentation, including photographs, condition reports, odometer and fuel readings, and digital signatures; and
• Timestamps of all booking-related actions.

• Communications Data

• Messages exchanged between Users through the Platform's in-app messaging system;
• Ratings and reviews submitted by Users; and
• Customer support correspondence with Lakbai.

• User Research and Survey Data

If you choose to participate in user research initiatives, feedback programs, or community surveys conducted by Lakbai, we may collect information you voluntarily provide, including written responses, preferences, and, where applicable and with your consent, audio or video recordings.\

• Identity Verification Data

As part of Lakbai's in-house identity verification process, Lakbai directly collects and processes the following data from all Users at registration:

• A selfie photograph taken while holding a valid government-issued identification document, used to verify that the submitting individual matches the identity document presented; 
• Facial geometry data derived from the selfie photograph for the purpose of liveness detection and identity matching; and 
• Document scan or image data extracted from the government-issued identification document held in the selfie.

Where facial geometry or other biometric data is derived from your selfie photograph, such data constitutes sensitive personal information under Section 3(l) of the DPA. Lakbai shall obtain your separate and explicit consent before processing such biometric data. Such data is processed solely for identity verification purposes and is retained in accordance with Section 7 of this Policy.

3.2. Information Automatically Collected

• Device and Technical Data

• IP address and device identifiers;
• Browser type, operating system, and device type;
• Platform usage logs, session data, and clickstream data; and
• Cookies and similar tracking technologies, subject to Section 11 of this Policy.

• Location Data

With your consent, we may collect real-time and historical location data from your device when you use the Platform for trip-related functions, including vehicle handover coordination and trip monitoring. You may disable location sharing through your device settings, but certain Platform features may be limited as a result.

3.3. Information from Third-Party Sources

• Background and Driving Record Data

To the extent permitted by applicable Philippine law, Lakbai or its authorized third-party providers may obtain background information about Users from public records or authorized data sources, including driving history records from the Land Transportation Office (LTO) and such other information as may be lawfully obtained for verification, fraud prevention, and safety purposes. Such processing shall be carried out in accordance with the DPA and applicable NPC issuances.

• Third-Party and Social Login Services

If you choose to register or log in to the Platform using a third-party authentication service (such as Google or Apple), that service may transmit to Lakbai certain account and profile information, such as your name and email address, as authorized by you. Lakbai will use such information only in accordance with this Policy. We are not responsible for how those third-party services collect or use your information.

• In-Vehicle Devices and Telematics

Vehicles listed on the Platform may have third-party devices installed by Hosts, including GPS trackers, dashcams, or on-board diagnostic (OBD) systems. These devices are operated by the Host or the relevant third-party service provider and are not controlled by Lakbai. Where such devices generate data about a trip (including location, speed, braking patterns, or other vehicle performance data) and such data is disclosed to Lakbai, Lakbai may use that data in connection with dispute resolution, safety monitoring, and enforcement of the Terms of Service. Users should be aware that in-vehicle devices may record their activities during a trip. Lakbai shall notify Renters of the presence of any known in-vehicle device as part of the pre-trip documentation process, where such information is disclosed by the Host.

• Other Third-Party Sources

To the extent permitted by applicable law, Lakbai may receive additional information about Users from other lawful sources, including fraud prevention services and other data providers. Such information may be combined with other personal data we hold about you to improve the accuracy of our records and to support Platform integrity.

3.4. Sensitive Personal Information

The following categories of data collected by Lakbai may constitute sensitive personal information under Section 3(l) of the DPA:

• Government-issued identification numbers peculiar to an individual (e.g., PhilSys number, SSS/GSIS number), processed solely for KYC and identity verification purposes;
• License or permit information issued by government agencies (e.g., LTO driver's license data); and
• Biometric data (such as facial geometry data), derived by Lakbai directly from selfie photographs submitted during registration for identity verification and liveness detection, subject to your separate and explicit prior consent.

Lakbai processes sensitive personal information only to the minimum extent necessary for the declared purposes herein and subject to the safeguards described in this Policy. You expressly consent to the processing of your sensitive personal information by submitting such data and completing the registration process, subject to the additional consent requirement for biometric data described above.

3.5. Data of Non-Registered Third Parties Submitted by Users

Where a registered User submits personal data pertaining to an individual who is not a registered User of the Platform, Lakbai shall process such data only to the minimum extent necessary for the declared purpose. This applies to the following categories of third-party data submissions:

• Authorized Additional Drivers

Where a Renter designates an additional authorized driver for a booked vehicle, the Renter shall submit the following data pertaining to that individual:

• Full legal name;
• Date of birth;
• Valid driver’s license number, license type, and expiry date; and
• A clear photograph of the driver's license.

The Renter represents and warrants, by submitting such data, that the additional driver has consented to and been informed of such submission and this Policy.

• Vehicle Co-Owners and Co-Registrants

Where a vehicle listed on the Platform is co-owned or co-registered with another individual who is not a registered User, the Host shall submit such data as is required to verify the vehicle's registration and ownership, including the name and identification details of the co-owner or co-registrant as appearing on the OR/CR or other registration documents.

• Authorization Letters and Special Powers of Attorney

Where a registered User is not the registered owner of a vehicle or is acting on behalf of another individual in connection with a booking or transaction, Lakbai may require the submission of a duly executed authorization letter or duly notarized Special Power of Attorney (“SPA”). Such document may contain personal data of the authorizing individual ("Principal"), including:

• Full legal name and signature of the Principal;
• Government-issued identification details of the Principal; and
• The nature and scope of the authority granted.

Lakbai shall process such data solely for the purpose of verifying the User's authority to act in connection with the relevant vehicle or transaction. The User submitting the authorization letter or SPA represents and warrants that: (i) the document is authentic and duly executed; (ii) the Principal has been informed of and consents to the submission of their personal data to Lakbai; and (iii) the User has the legal authority to submit such data on the Principal's behalf.

• Lakbai's Obligations Regarding Third-Party Data

With respect to all personal data submitted under this Section 3.5, Lakbai shall:

• Process such data only to the extent necessary for the declared purpose of verification or booking facilitation;
• Retain such data in accordance with the retention schedules in Section 7;
• Implement the same security measures applicable to registered User data under Section 8; and
• Where practicable, notify the relevant third party of the processing of their personal data at the next practicable opportunity, consistent with the Right to be Informed under Section 34(a) of the IRR.

Section 4

Purpose of Processing

4.1. Account Registration and Identity Verification (KYC)

• To verify the identity of Users prior to granting access to the Platform;
• To conduct Know-Your-Customer (KYC) procedures directly through Lakbai's in-house verification process, including the collection of selfie photographs with valid identification and biometric liveness checks;
• To confirm age eligibility (18 years and above) and legal capacity to contract; and
• To verify the validity of driver's licenses, vehicle documents, and other submitted credentials.

4.2. Platform Operations and Booking Facilitation

• To enable and manage the booking process between Hosts and Renters;
• To facilitate pre-trip and post-trip vehicle condition documentation;
• To process payments, platform service fees, and trip fees; and
• To generate and maintain transaction and booking records.

4.3. Safety and Insurance

• To facilitate the provision of per-trip insurance coverage through Lakbai's licensed insurance partner;
• To process and manage claims or disputes arising from vehicle damage, accidents, or incidents; and
• To cooperate with law enforcement, insurance investigators, or government agencies in relation to Platform incidents.

4.4. Platform Communications

• To send booking confirmations, updates, alerts, and notifications;
• To facilitate in-app messaging between Users; and
• To respond to inquiries, complaints, and customer support requests.

4.5. Ratings, Reviews, and Community Trust

• To enable Users to rate and review each other following completed trips; and
• To maintain Platform integrity and trust through community accountability mechanisms.

4.6. Marketing and Advertising

Subject to your consent or opt-in where required by law, Lakbai and its authorized advertising partners may use your personal data for the following marketing and advertising purposes:

• Direct Marketing. We may send you marketing communications about Lakbai's services, promotions, and offers through email, SMS, push notifications, or other channels, where permitted by applicable law. You may opt out of receiving marketing communications at any time by following the unsubscribe instructions in any marketing message, by adjusting your notification preferences in your account settings, or by submitting a request to Lakbai's DPO. Opting out of marketing communications will not affect your receipt of transactional or service-related messages.
• Interest-Based Advertising. We may work with third-party advertising partners to display advertisements on the Platform and on third-party websites and applications. These partners may use cookies and similar technologies to collect information about your interactions with the Platform and other sites over time, in order to serve advertisements that may be relevant to your interests. You may limit interest-based advertising by adjusting your cookie preferences through the cookie settings available on the Platform, or by using browser-level opt-out tools. Please note that opting out of interest-based advertising does not mean you will not see any advertisements, you may still see generic, non-targeted ads.
• User Research and Promotions. We may use your personal data to invite you to participate in surveys, user research, contests, or promotional programs. Participation is voluntary.

Where we intend to process your personal data for marketing purposes not described in this Policy, we will notify you in advance and obtain your consent where required by the DPA and applicable NPC issuances.

4.7. Legal and Regulatory Compliance

• To comply with applicable Philippine laws and regulations, including the DPA, Electronic Commerce Act, Internet Transactions Act of 2023, and applicable tax laws;
• To respond to lawful orders, subpoenas, warrants, or requests from courts, government agencies, law enforcement authorities, or the NPC;
• To establish, exercise, or defend legal claims; and
• To register with and report to the NPC as required.

4.8. Analytics, Research, and Product Development

• To analyze usage patterns and improve the Platform's features, functionality, and user experience;
• To create aggregated, de-identified, or anonymized data from personal data for internal research, analytics, and business development; and
• To share anonymized or aggregated data with third parties for lawful business purposes, including industry benchmarking and platform optimization. Such data will not identify you individually.

4.9. Account Security and Fraud Prevention

• To detect, investigate, and prevent fraud, unauthorized access, and other prohibited conduct; and
• To enforce the Terms of Service, including suspension and termination of accounts.

Section 5

Legal Bases for Processing

Lakbai processes personal data on the following legal bases under Sections 12 and 13 of the DPA, as applicable to each processing activity:

• Consent: Where you have freely given your specific, informed, and unambiguous consent to the processing, including consent to the processing of sensitive personal information for KYC purposes, biometric data derived from selfie photographs collected and processed directly by Lakbai for identity verification and liveness detection;
• Contractual Necessity: Where processing is necessary to fulfill obligations under the Terms of Service or to take steps at your request prior to entering into such agreement;
• Legal Obligation: Where processing is necessary to comply with a legal obligation to which Lakbai is subject, including regulatory reporting, tax compliance, and NPC registration requirements;
• Legitimate Interests: Where processing is necessary for the legitimate interests of Lakbai or third parties, such as fraud prevention, platform security, and non-personalized analytics, except where overridden by your fundamental rights and freedoms; and
• Protection of Vital Interests: Where processing is necessary to protect the life and health of a User or another person.

Section 6

Data Sharing and Disclosure

6.1. Public Profile Information

Certain information you provide on the Platform will be visible to other Users or to the general public as part of your public profile or vehicle listing. Public-facing information may include:

• Your first name and profile photograph;
• Your user ratings and reviews received from other Users;
• For Hosts: vehicle listing details, general pickup location, calendar availability, and listing description.

You should take care when choosing what information to include in your profile. Lakbai does not control the use of publicly visible information by other Users or third parties who access it through the Platform.

6.2. Sharing Between Users

When a booking is confirmed, limited identity and contact information, such as first and last name and contact number, will be disclosed between the relevant Host and Renter to enable vehicle handover and trip coordination. Where trip photographs are submitted as part of pre-trip or post-trip documentation, such photographs may be shared with the counterparty to the booking. Such sharing is limited to the minimum necessary for the declared purpose.

6.3. Third-Party Service Providers (Personal Information Processors)

Lakbai engages third-party personal information processors who process personal data on our behalf and strictly under our instructions. These currently include:

• Payment processors, for processing rental payments, platform fees, and security deposits;
• Licensed insurance partners, for underwriting and administering per-trip insurance coverage;
• Advertising and analytics partners, for marketing, interest-based advertising, and Platform analytics, subject to Section 4.6; and
• Cloud hosting, data storage, and IT service providers, for operating and maintaining the Platform's technical infrastructure.

All third-party processors are bound by appropriate contractual obligations consistent with Section 14 of the DPA and Rule X of the IRR, and are required to implement data protection measures equivalent to those imposed on Lakbai.

6.4. Law Enforcement and Government Disclosure

Lakbai may disclose User personal data to any government authority, law enforcement agency, court, or regulatory body, including the NPC, when required to do so by law, court order, subpoena, or other legal process, or when Lakbai in its reasonable judgment believes that disclosure is necessary to prevent fraud, protect the safety of any person, or fulfill a legal obligation. Such disclosure shall be made in good faith and only to the minimum extent required by the applicable legal basis.

6.5. Corporate Transactions

In the event of a merger, acquisition, corporate reorganization, or sale of all or substantially all of Lakbai's assets, personal data held by Lakbai may be transferred to the relevant successor entity, subject to equivalent data protection obligations.

6.6. Anonymized and Aggregated Data

Lakbai may share aggregated, de-identified, or anonymized data derived from personal data with third parties for lawful business purposes, including market research, platform benchmarking, and advertising analytics. Such data will not identify you personally and is not subject to the data subject rights described in Section 10.

6.7. Cross-Border Transfers

Some of Lakbai's third-party service providers may process personal data outside the Philippines. In such cases, Lakbai shall ensure that appropriate contractual safeguards are in place to provide a comparable level of protection, consistent with Section 21 of the DPA and Rule XII of the IRR.

Section 7

Data Retention

Personal data shall be retained only for as long as necessary for the fulfillment of the purposes for which it was collected, consistent with Section 11(e) of the DPA and Section 19(d) of the IRR. The following retention periods apply:

• Account and KYC data: Retained for the duration of your active account plus five (5) years following account closure, to support post-termination dispute resolution and legal compliance;
• Biometric data: Retained only for the duration necessary to complete identity verification, after which it shall be deleted or de-identified by Lakbai in accordance with this Policy and applicable law. Selfie photographs submitted for identity verification shall be retained as part of the User's KYC record for the duration of the active account and for five (5) years following account closure, consistent with the account and KYC data retention period above;
• Transaction and booking records: Retained for a minimum of five (5) years from the date of the transaction, consistent with applicable commercial and tax record-keeping requirements;
• In-app communications: Retained for the duration of the account and for three (3) years following the last transaction between the relevant parties;
• Legal hold data: Where personal data may be relevant to pending or anticipated litigation, regulatory investigation, or legal claim, such data shall be retained for the duration of such matter and for the applicable prescription period thereafter;
• Location data: Retained for the duration of the trip and for ninety (90) days thereafter, unless required for dispute resolution or legal purposes; and
• Marketing and advertising data: Retained for the period during which you have an active account, unless you opt out, upon which marketing data shall be suppressed or deleted within a reasonable period.

Upon expiration of the applicable retention period, personal data shall be securely disposed of or anonymized in a manner that prevents further processing, unauthorized access, or disclosure, consistent with Section 19(d)(3) of the IRR.

Section 8

Security of Personal Data

Lakbai implements reasonable and appropriate organizational, physical, and technical security measures to protect personal data against accidental or unlawful destruction, alteration, unauthorized disclosure, or any other form of unlawful processing. These measures are consistent with Section 20 of the Data Privacy Act (DPA) and Rules VI and XXVIII of its Implementing Rules and Regulations (IRR).

Lakbai employs a combination of technical, physical, and organizational safeguards designed to protect personal information against unauthorized access, destruction, or alteration while it is under our control. However, no method of transmitting or storing information is 100% secure. Accordingly, we cannot guarantee the absolute security of your personal information. By using the platform, you hereby acknowledge and agree that Lakbai cannot absolutely guarantee the security of your personal information.

Section 9

Cookies and Similar Technologies

The Platform uses cookies and similar tracking technologies to enhance your experience, analyze usage patterns, support Platform security, and deliver advertising. The types of cookies we use include:

• Essential cookies: Strictly necessary for the Platform to function, and cannot be disabled;
• Functional cookies: Enable enhanced functionality and personalization, such as remembering your preferences;
• Analytics cookies: Help us understand how Users interact with the Platform on an aggregate basis;
• Advertising cookies: Used by Lakbai and its advertising partners to deliver interest-based advertisements on and off the Platform, to measure advertising effectiveness, and to build audience profiles; and
• Security cookies: Used to detect and prevent fraudulent or unauthorized activity.

You may configure your cookie preferences through the cookie settings available on the Platform or through your browser settings. You may choose to disable non-essential cookies at any time; however, doing so may limit certain Platform features. Disabling advertising cookies will limit Lakbai's ability to serve you personalized advertisements but will not prevent the display of generic advertisements.

Section 10

Your Rights as a Data Subject

If you use the Services in the Philippines, you may exercise your rights as a data subject under Philippine laws. In exercising such right, you may contact us at dpo@mguylawoffice.com

10.1. Withdrawal of Consent

Where Lakbai processes your personal data on the basis of your consent, you have the right to withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out based on consent prior to its withdrawal.

Please note that withdrawal of consent to the processing of data that is essential to the operation of your account (such as identity verification data) may result in the suspension or closure of your account, as Lakbai requires such data to provide the Platform's services and to comply with applicable law. Lakbai will inform you of any such consequence prior to or at the time of your withdrawal request.

Consent for the processing of sensitive personal information submitted at registration is evidenced by your completion of the registration process and your affirmative agreement to this Policy. Withdrawal of such consent may be submitted in writing to Lakbai’s DPO.

10.2. Account Closure and Data Deletion

If you wish to close your Lakbai account and request deletion of your personal data, you may submit a request by:

• Emailing Lakbai’s DPO at [dpo@mguylawoffice.com] with the subject line “Account Closure Request”; or
• Submitting a written request through the in-app support channel.

Lakbai will process your account closure request within a reasonable period following identity verification. Upon closure, Lakbai will delete or anonymize your personal data, subject to the following:

• Lakbai may be unable to delete personal data needed to comply with applicable laws, detect or prevent fraud, collect outstanding fees, resolve pending disputes, process claims, conduct audits, or establish and defend legal claims;
• Transaction records and legally required data shall be retained for the periods specified in Section 7, notwithstanding account closure; and
• Residual copies of data may persist in backup systems for a limited period before permanent deletion, during which time such data shall be isolated from active processing.

Following account closure, Lakbai shall honor your right to erasure to the maximum extent permitted by law.

Section 11

Automated Processing and Profiling

The Platform employs certain automated processes in connection with User interactions, including:

• Age verification at registration, which automatically blocks applicants below 18 years of age based on their declared birthdate;
• Automated fraud detection and risk-scoring for transaction monitoring and account security purposes; and
• Interest-based advertising profiling, where your Platform activity and interaction data may be used to build audience segments for targeted advertising, subject to Section 4.6 and your advertising preferences under Section 12.

Where any decision that significantly affects your rights or interests is made solely on the basis of automated processing, Lakbai shall notify you and provide you with an opportunity to contest such decision, consistent with Section 48 of the IRR. Lakbai shall ensure appropriate human review of such decisions, where feasible.

Acknowledgment and Acceptance

By registering for, accessing, or continuing to use the Lakbai Platform, you confirm that:

• You have read, understood, and agree to be bound by this Privacy Policy;
• You consent to the collection, use, storage, and processing of your personal data, including any sensitive personal information, as described herein;
• You are at least eighteen (18) years of age and have the legal capacity to provide the consent described in this Policy; and
• You have been informed of your rights as a data subject under the DPA and of the means by which you may exercise such rights.

This Privacy Policy was prepared by Lakbai in compliance with Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations. Questions or concerns regarding this Policy may be directed to Lakbai’s Data Protection Officer.