Effective Date: 30 October 2023
This Privacy Notice and its Addendum(s) (“Privacy Notice”) describe how Grab Holdings Limited, its respective subsidiaries, affiliates, associated companies and jointly controlled entities (collectively “Grab”, “we”, “us” or “our”) collect, use, process and disclose your Personal Data through the use of Grab’s mobile applications and websites (respectively “Apps” and “Websites”), as well as products, features and other services globally, operated by Grab (collectively, “Services”).
This Notice applies to our consumers, agents, vendors, suppliers, partners (such as driver, delivery and merchant partners), contractors and service providers (collectively “you”, “your” or “yours”).
“Personal Data” is any information which can be used to identify you or from which you are identifiable. This includes but is not limited to your name, nationality, telephone number, bank and credit card details, personal interests, email address, your image, government-issued identification numbers, biometric data, race, date of birth, marital status, religion, health information, vehicle and insurance information, employment information and financial information.
We typically collect, use, disclose or otherwise process your Personal Data in accordance with this Privacy Notice with your consent, or in compliance with applicable laws, such as where:
We collect Personal Data about you in the ways listed below. We may also combine Personal Data collected via these various channels:
We collect your Personal Data when you provide it to us. For example, when you:
Personal Data may be collected through the normal operation or use of our Apps, Websites and Services. Some examples are:
We may collect Personal Data, including but not limited to your name, contact information and other identification information where needed from other sources. Such sources include:
Some of the Personal Data that we collect may be sensitive in nature. This may include Personal Data pertaining to your race, national ID information, religious beliefs, background information (including financial and criminal records, where legally permissible), health data, disability, marital status and biometric data, as applicable. We collect sensitive Personal Data only with your consent and/or in strict compliance with applicable laws. In the event that you are required to furnish any documentation or information to us for any Purpose which may contain such sensitive Personal Data (which is not required that Purpose), you agree to redact such sensitive Personal Data before providing such documentation or information to us.
In some situations, you may provide Personal Data of other individuals (such as your spouse, family members or friends) to us. For example, you may add them as your emergency contact, when you use the in-app chat or when you add them as recipients or beneficiaries of any use of our Services. If you provide us with their Personal Data, you represent and warrant that you have obtained their consent for their Personal Data to be collected, used and disclosed as set out in this Privacy Notice.
As a parent or legal guardian, please do not allow minors under your care to submit Personal Data to Grab. In the event that such Personal Data of a minor is disclosed to Grab, you hereby consent to the processing of the minor’s Personal Data and accept and agree to be bound by this Notice and take responsibility for his or her actions.
Grab may use your Personal Data for the following purposes set out in the list below. (“Purposes”). Additionally, if you use Grab in various capacities (for example, if you use multiple Grab Services, or if you are both a driver partner/delivery partner and a consumer), we may link your Personal Data collected across your various capacities to facilitate your use of our Services and for the Purposes described below:
Your Personal Data will be used to provide, personalise, maintain and improve our Apps, Websites and Services. This includes using your Personal Data to:
We use your data to ensure the safety and security of our Services and all users. This includes:
We use Personal Data to resolve user support issues. For example, we may:
We may use the Personal Data we collect for testing, research, analysis and product development. This allows us to understand and analyse your needs and preferences, protect your Personal Data, improve and enhance the safety and security of our Services, develop new features, products and services, and facilitate development of insurance and finance solutions.
We may use the Personal Data we collect for legal purposes, such as to investigate and resolve claims or disputes, detect/prevent/prosecute crime, or as allowed or required by applicable law.
We may also use your Personal Data when we are required, advised, recommended, expected or requested to do so by our legal advisors or any local or foreign legal, regulatory, governmental or other authority.
For example, we may use your Personal Data to:
We may use your Personal Data to send you marketing communications relating to customised products or services (that may be of interest or relevance based on your profile), or Grab’s partners’, sponsors’ and advertisers’ products, services, events or promotions. For example, we may:
We may communicate such marketing to you by various means, where applicable (including by SMS, chat applications (e.g. WhatsApp, Telegram, LINE, Viber, WeChat, Zalo), push notification, call, and by email).
If you wish to unsubscribe to the receiving of such marketing communications, please click on the unsubscribe link in the relevant email or message. Alternatively, you may also update your preferences in our App settings. Please note that while you may opt out of marketing or promotion communications, Grab may still send you account and / or service-related messages (such as two-factor authentication, information on your transactions, rewards, etc.).
User Published Content
If you publish content (such as a review or comment) on Grab’s platform, it will be shown publicly along with your personal data (such as profile name, uploaded photo(s)), and other information you choose to include in your content. For more information, see our Review Guidelines.
We need to share Personal Data with various parties for the Purposes. These parties include:
We share Personal Data with our subsidiaries, associated companies, jointly controlled entities and affiliates. The companies in the Grab group share resources, such as infrastructure and technology with each other to provide you with a consistent, relevant and secure experience when you use our products or Services, and for the Purposes set out in this Privacy Notice.
For example, we do this to make your experience more seamless, such as by automatically completing your registration information from your use of one Grab Product or Service when you sign up for a new Grab Product or Service.
We may provide Personal Data to our vendors, consultants, marketing partners, research firms, and other service providers or business partners. This includes:
We may share your Personal Data with our legal advisors, law enforcement officials, government authorities and other third parties. This may take place to fulfil the legal purposes (mentioned above), or any of the following circumstances:
We may share your Personal Data with other parties, in connection with any acquisitions, sales, mergers, joint ventures, consolidation, restructuring, financing or any other type of business transactions. Your Personal Data will however remain subject to our obligations made in any pre-existing Privacy Notice that you have agreed to.
We retain your Personal Data for the period necessary to fulfill the Purposes outlined in this Notice unless a longer retention period is required or allowed by law. Once your Personal Data is no longer necessary for the Services or Purposes, or we no longer have a legal or business purpose for retaining your Personal Data, we take steps to erase, destroy, anonymise or prevent access or use of such Personal Data for any purpose other than compliance with this Notice, or for purposes of safety, security, fraud prevention and detection, in accordance with the requirements of applicable laws.
Your Personal Data may be transferred from the country, state and city (“Home Country”) in which you are present while using our Services to another country, state and city (“Alternate Country”).
When we transfer your Personal Data from your Home Country to the Alternate Country, we will comply with our legal and regulatory obligations in relation to your Personal Data, including having a lawful basis for transferring Personal Data and putting appropriate safeguards in place to ensure an adequate level of protection for the Personal Data. We will also ensure that the recipient in Alternate Country is obliged to protect your Personal Data at a standard of protection comparable to the protection under applicable laws.
Our lawful basis will be either consent (i.e. we may ask for your consent to transfer your Personal Data from your Home Country to the Alternate Country at the time you provide your Personal Data) or one of the safeguards permissible by laws.
Cookies may have unique identifiers, and reside, among other places, on your computer or mobile device, in emails we send to you, and on our web pages. Cookies may be used for various purposes such as to:
You have the right to choose to disable, block or deactivate cookies. Please note that however refusal or removal of some cookies could affect the availability, functionality or use of our Website, Services or Apps.
You may adjust your internet browser settings to disable, block or deactivate cookies, delete your browsing history or clear the cache from your internet browser. The settings may be contained within the “History”, “Preferences”, “Settings” or “Privacy” section of your internet browsers, or you may otherwise consult the help section of your internet browser for more information. You may also adjust your cookie settings here:
We may facilitate the display of targeted advertising on other platforms, such as on other online platforms that you may be a user of.
You may be able to limit our use of your Personal Data to display targeted advertisements on behalf of our advertisers, by adjusting your preference through our Grab App. Depending on the type of phone and operating software that you are using, you may be granted the option to disable our use of mobile identifiers (such as Apple’s IDFA or Google’s GAID) and the ability to track you across apps and websites owned by other companies by adjusting the settings available on your mobile devices. Through adjusting the settings on your device, you can typically reset, delete, limit and/or otherwise restrict the use of such mobile identifiers.
Although we will not use your Personal Data to show you such targeted advertisements on other platforms, you may still see generic ads that appear relevant to you. This may be because we have engaged third party advertisers / platforms to display ads to users of specific attributes or demographic makeups who may find them relevant. You may be able to limit seeing these advertisements through managing your preferences on these platforms.
We will take reasonable legal, organisational and technical measures to ensure that your Personal Data is protected. This includes measures to prevent Personal Data from getting lost, or used or accessed in an unauthorised way. We limit access to your Personal Data to our employees on a need to know basis. Those processing your Personal Data will only do so in an authorised manner and are required to treat your information with confidentiality.
Nevertheless, please understand that the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data transmitted through any online means, therefore, any transmission remains at your own risk.
In accordance with applicable laws and regulations, you may be entitled to:
Where you are given the option to share your Personal Data with us, you can always choose not to do so. If we have requested your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. However, choosing not to share your Personal Data with us, withdrawing your consent to our use of it or to your agreement with our Privacy Notice could mean that we are unable to perform the actions necessary to achieve the purposes of processing described in Section II (Use of Personal Data) or that you are unable to make use of App or the Services.
After you have chosen to withdraw your consent, we may be able to continue to process your Personal Data to the extent required or otherwise permitted by applicable laws and regulations.
We will screen and verify all requests beforehand. In order to verify your authority to make the request, we may require you to provide supporting information or documentation to corroborate the request. Once verified, we will give effect to your request within the timelines prescribed by applicable laws.
Grab may modify, update or amend the terms in this Privacy Notice at any time. Such amendments shall be notified to you through the Application and/ or other appropriate means at least five (5) business days before the effective date. The updated version will be posted on the website https://www.grab.com. It is your responsibility to review the Privacy Notice regularly. Your continued use of the Apps, Websites or Services, purchase products from Grab or continuing to communicate or engage with Grab following the modifications, updates or amendments to this Notice, whether or not reviewed by you, shall constitute your agreement to be bound by such amendments.
If you have any queries about this Notice or would like to exercise your rights set out in this Notice , please fill-in the following form or direct your mail to our Data Protection Officer. :
For users in Philippines,
Name: MyTaxi PH Inc (Attention: Grab Privacy Office)
Address: Address: Level 27&28 Exquadra Tower – Lot 1A Exchange Road corner Jade Street, Ortigas Center Pasig City, Philippines
For users in Thailand,
Name: Grabtaxi (Thailand) Co., Ltd. (Attention: Grab Privacy Office)
Address: Address: 252 SPE Tower, 10th floor, Phahonyothin Rd,Samsen Nai, Phaya Thai, Bangkok 10400, Thailand
For users in other countries,
Name: c/o Grab Holdings Limited. (Attention: Grab Privacy Office)
Address: 3 Media Close, Singapore 138498
In order for us to attend to your queries expeditiously, we prefer that inquiries be made via the online form.
The original of this Notice is written in the English language. In the event of any conflict between the English and other language versions, the English version shall prevail.
ADDENDUM 1: GRAB FOR BUSINESS
This Addendum forms part of the Grab Privacy Notice. In the event of any inconsistency between the Grab Privacy Notice and this Addendum, this Addendum shall prevail.
Grab for Business is provided as an add-on feature for organisations (“Client”) to facilitate corporate billing for itsAuthorised Users’ (e.g. employees) use of Grab’s Services in the course of work.
When a Client chooses to utilise Grab for Business, the Authorised User is given the option of tagging his/her rides or other transactions to the Client or to tag it as a personal ride. As part of this feature, Grab will disclose detailed trip and booking information that Authorised Users have tagged as being for business purposes to the Client. Apart from this, Grab does not disclose other Personal Data of Authorised Users to the Client.
Alternatively, an individual user may choose to set up a business profile within the App to facilitate the tagging of business-related rides and to generate consolidated trip reports to facilitate the submission of claims from his or her employer. When used in this mode, the claims process is user-driven and the user’s employer need not be a Client.
For ease of reference, Authorised Users and individual users will each be referred to as a “User” and collectively as “Users” in this Addendum.
In respect of any User and the processing of their Personal Data , Grab acts as a data controller. For further information on how Grab collects, uses and discloses Users’ Personal Data, please refer to the Grab Privacy Notice.
Due to the way Grab for Business works, Grab does not process any Personal Data for and on behalf of the Client. Accordingly, Grab is not the data processor of the Client, but an independent data controller in respect of all Personal Data that it processes in the course of providing the Grab for Business feature. Likewise, the Client is an independent data controller of the Personal Datathat it discloses to and/or receives from Grab.
In order to provide the Grab for Business feature, the User or the Client will be required to provide the following information about the User to Grab:
Grab will use this information for the purposes of:
Upon onboarding aUser to the App, Grab will process the Personal Data of the User in accordance with the Grab Privacy Notice and this Addendum.
Grab will disclose relevant trip and booking information as determined by Grab from time to time to the Client to facilitate Corporate Billing.
Depending on the business profile settings selected by the individual user, the user may retrieve and generate reports containing his/her relevant trip and booking information.
The Client and Grab shall each:
ADDENDUM 2: GRABDEFENCE PRIVACY STATEMENT
This Privacy Statement (“Statement”) describes how Grab collects, uses, processes and discloses data through use of GrabDefence and its related services (“GrabDefence”).
Grab provides its customers (“GD Customers”) with the GrabDefence service that helps to prevent, detect, and combat fraud or unsafe activities on their platforms and applications (such as web-based and mobile applications based e-commerce platforms) (“Digital Platforms”). GD Customers will integrate GrabDefence into their Digital Platforms to identify potentially fraudulent activities on their Digital Platforms.
This Statement applies to the users of GD Customers’ Digital Platforms (“you”), and strictly relates to the data collected, used and disclosed on behalf of GD Customers for the purposes of providing GrabDefence. Kindly refer to the applicable terms of service and/or privacy notices of the GD Customers to understand how they otherwise collect, use and disclose your data.
To provide GrabDefence to GD Customers, information from your device and information relating to your use of GD Customers’ Digital Platform will be collected from GD Customers. Such information include device identifier information (such as IMEI, Android ID, MAC address etc), device and hardware information (such as device name, screen size etc), account information (such as email address, phone number, etc) as well as other contextual data in relation to your use of GD Customers’ Digital Platforms (such as IP address, Wifi address, GPS location data, address, payment details etc). Such information is collected by GD Customers when you interact with GD Customers’ Digital platforms, in accordance with GD CUstomers’ terms of service and/or privacy notices.
We may combine the information we have collected from GD Customers with data points from Grab’s ecosystem to derive relevant insights (for example, insights on whether there are signs of app modification, data manipulation, device tampering, GPS spoofing). We do not attempt to personally identify you based on the information above in order to provide GrabDefence to GD Customers.
We generally process your information on behalf of GD Customers in order to assist with their fraud detection efforts. It is up to the GD Customers’ sole discretion to apply the outcome derived from the use of GrabDefence on their Digital Platforms.
In this regard, we may use, combine and process your information for the following purposes (“Purposes”):
Please be assured that the information collected will not be used by Grab for any marketing efforts or combined with any other datasets available to Grab in a manner that unfairly prejudices you.
We may need to share information with various parties for the Purposes. These parties include:
Save for the abovementioned parties, we will not disclose your information to any other third party.
In accordance with applicable privacy laws and to the extent that any information collected pursuant to the use of GrabDefence may constitute personal data, you may be entitled to access or update your personal data. Given that GrabDefence’s processing of your personal data is premised on GD Customers’ use of GrabDefence when you use their Digital Platforms, if you would like to exercise your rights, we recommend that you directly approach the operator of the Digital Platform you are using to obtain more information about how your information is used and processed, and to exercise your rights over your personal data.
We retain your information for as long as we have a business purpose (i.e. to provide GrabDefence, and to fulfil the Purposes) or legal purpose to do so. Once these purposes are satisfied, we take steps to destroy or anonymise your information.
Your information may be transferred from the country, state and city (“Home Country”) in which you are present while using GD Customers’ Digital Platforms to another country, state and city (“Alternate Country”).
We will take reasonable legal, organisational and technical measures to ensure that your information is protected. This includes measures to prevent data from getting lost, or used or accessed in an unauthorised way. We limit access to your information to our employees on a need to know basis. Those processing your data will only do so in an authorised manner and are required to treat your information with confidentiality.
Nevertheless, please understand that the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of your information transmitted through any online means, therefore, any transmission remains at your own risk.
Grab shall have the right to modify, update or amend the terms of this Statement at any time by placing the updated Statement on its website.
If you have any queries about how your data is being used, please reach out to the GD Customer with whom you may be registered as a user. If you have other queries relating to GrabDefence, please contact our Data Privacy Officer via the form set out in Grab’s Privacy Notice.