Effective from: 07 June 2021
This Privacy Notice and its Addendum(s) (“Notice”) describe how Grab Holdings Inc, its respective subsidiaries, affiliates, associated companies and jointly controlled entities (collectively “Grab”, “we”, “us” or “our”) collect, use, process and disclose your Personal Data through the use of Grab’s mobile applications and websites (respectively “Apps” and “Websites”), as well as products, features and other services globally, operated by Grab (collectively, “Services”).
This Notice applies to our consumers , agents, vendors, suppliers, partners (such as driver and merchant partners), contractors and service providers (collectively “you”, “your” or “yours”).
“Personal Data” is any information which can be used to identify you or from which you are identifiable. This includes but is not limited to your name, nationality, telephone number, bank and credit card details, personal interests, email address, your image, government-issued identification numbers, biometric data, race, date of birth, marital status, religion, health information, vehicle and insurance information, employment information and financial information.
I. COLLECTION OF PERSONAL DATA
We collect Personal Data about you in the ways listed below. We may also combine the collected Personal Data with other Personal Data in our possession. If you have or are a party to multiple relationships with us (for example if you use our Services across our various business verticals, or if you are both a driver partner/delivery partner as well as a consumer to our Apps or on our other business verticals), we will link your Personal Data collected across your various capacities to facilitate your use of our Services and for the Purposes described below.
You provide your Personal Data to us
We collect your Personal Data when you voluntarily provide it to us. For example, you may provide your Personal Data to us when you:
In certain circumstances, you may need to provide your Personal Data in order to comply with legal requirements or contractual obligations, or where it is necessary to conclude a contract. Failure to provide such Personal Data, under such circumstance, may constitute failure to comply with legal requirements or contractual obligations, or inability to conclude a contract with you, as the case may be.
For purposes such as detection and prevention of fraud, we may also collect your Personal Data without consent, by relying on Legitimate Interests or other exemptions provided by the applicable data privacy laws.
When our services are used
Personal Data may be collected through the normal operation of our Apps, Websites and Services. Some examples are:
From other sources
When we collect Personal Data, including but not limited to your name, contact information and other identification information where needed from other sources, we make sure that that data is transferred to us in accordance with applicable laws. Such sources include:
Personal Data about driver partners
If you are a driver partner, we may collect:
Sensitive Personal Data
Some of the Personal Data that we collect is sensitive in nature. This includes Personal Data pertaining to your race, national ID information, religious beliefs, background information (including financial and criminal records, where legally permissible), health data, disability, marital status and biometric data, as applicable. We collect this information only with your consent and/or in strict compliance with applicable laws.
Grab’s applications or devices
Grab may install in-vehicle audio and/or video recording applications or devices to promote the safety and security of Grab driver partners, delivery partners and passengers of driver partners. Your Personal Data may be captured in these audio and/or video recordings. Where in-vehicle audio and/or video recordings are made, such recordings are collected, processed, used and stored in a manner that is compliant with applicable laws.
Personal In-vehicle cameras
Some Grab partners may install personal in-vehicle cameras in their vehicles for their own purposes (including safety and security). The use of such in-vehicle cameras is not endorsed or prohibited by Grab. The collection, use and disclosure of Personal Data obtained from personal in-vehicle cameras is the responsibility of the relevant partner. Please check with the relevant partner if you have any queries about their use of personal in-vehicle cameras.
Grab works with partners (including, but not limited to, Toyota and Hyundai) to install telematics devices in selected rental vehicles for the following purposes:
If you are a driver partner, these devices will collect telematics data (such as your speed, acceleration, and braking data) and your location information. If you are a passenger onboard one of the driver partners’ vehicles fitted with these devices, your location data (i.e. the position of the car) will be incidentally collected as well.
The data collected by these devices are owned by these partners who have entered into appropriate contractual undertakings with Grab to safeguard this data. While these partners share such telematics data with us (to enable us to fulfil the purposes stated above), we do not share any personally identifying information about our driver partners or passengers of driver partners.
Personal Data of minors
As a parent or legal guardian, please do not allow minors under your care to submit Personal Data to Grab. In the event that such Personal Data of a minor is disclosed to Grab, you hereby consent to the processing of the minor’s Personal Data and accept and agree to be bound by this Notice and take responsibility for his or her actions.
When you provide Personal Data of other individuals to us
In some situations, you may provide Personal Data of other individuals (such as your spouse, family members or friends) to us. For example, you may add them as your emergency contact or when you use the in-app chat. If you provide us with their Personal Data, you represent and warrant that you have obtained their consent for their Personal Data to be collected, used and disclosed as set out in this Notice.
II. USE OF PERSONAL DATA
Grab may use, combine and process your Personal Data for the following purposes (“Purposes”):
Providing services and features
Your Personal Data will be used to provide, personalise, maintain and improve our Apps, Websites and Services. This includes using your Personal Data to:
Safety and security
We use your data to ensure the safety and security of our Services and all users. This includes:
We use Personal Data to resolve user support issues. For example, we may:
Research and development and security
We may use the Personal Data we collect for testing, research, analysis and product development. This allows us to understand and analyse your needs and preferences, protect your Personal Data, improve and enhance the safety and security of our Services, develop new features, products and services, and facilitate insurance and finance solutions.
We may use the Personal Data we collect to investigate and resolve claims or disputes, or as allowed or required by applicable law. We may also use Personal Data without consent, by relying on Legitimate Interests or other exemptions provided by the applicable data privacy laws, for purposes such as detection and prevention of fraud.
We may also use your Personal Data when we are required, advised, recommended, expected or requested to do so by our legal advisors or any local or foreign legal, regulatory, governmental or other authority.
For example, we may use your Personal Data to:
We may also use your Personal Data in connection with mergers, acquisitions, joint ventures, sale of company assets, consolidation, restructuring, financing, business asset transactions, or acquisition of all or part of our business by another company.
Marketing and promotions
We may use your Personal Data to market Grab and Grab’s partners’, sponsors’ and advertisers’ products, services, events or promotions. For example, we may:
We may communicate such marketing to you by post, telephone call, short message service, online messaging service, push notification, by hand and by email.
If you wish to unsubscribe to the processing of your Personal Data for marketing and promotions, please click on the unsubscribe link in the relevant email or message. Alternatively, you may also update your preferences in our App settings.
III. DISCLOSURE OF PERSONAL DATA
We need to share Personal Data with various parties for the Purposes. These parties include:
With third parties
We may share your Personal Data with the following parties:
With Grab partners at your request
For example, if you requested a service through a Grab partner or used a promotion provided by a Grab partner, Grab may share your Personal Data with that Grab partners. Our partners include partners that integrate with our App or our App integrates with, vehicle services partners, or business partners which Grab collaborates with to deliver a promotion, competition or other specialised service.
With the owner of Grab accounts that you may use
For example, your employer may receive trip data when you use your employer’s Grab for Business account.
With subsidiaries and affiliates
We share Personal Data with our subsidiaries, associated companies, jointly controlled entities and affiliates.
With Grab’s service providers and business partners
We may provide Personal Data to our vendors, consultants, marketing partners, research firms, and other service providers or business partners. This includes:
With our legal advisors and governmental authorities
We may share your Personal Data with our legal advisors, law enforcement officials, government authorities and other third parties. This may take place to fulfil the legal purposes (mentioned above), or any of the following circumstances:
IV. RETENTION OF PERSONAL DATA
We retain your Personal Data for the period necessary to fulfill the Purposes outlined in this Notice unless a longer retention period is required or allowed by law. Once your Personal Data is no longer necessary for the Services or Purposes, or we no longer have a legal or business purpose for retaining your Personal Data, we take steps to erase, destroy, anonymise or prevent access or use of such Personal Data for any purpose other than compliance with this Notice , or for purposes of safety, security, fraud prevention and detection, in accordance with the requirements of applicable laws.
V. INTERNATIONAL TRANSFERS OF PERSONAL DATA
Your Personal Data may be transferred from country, state and city (“Home Country”) in which you are present while using our Services to another country, state and city (“Alternate Country”).
When we transfer your Personal Data from your Home Country to the Alternate Country, we will comply with our legal and regulatory obligations in relation to your Personal Data, including having a lawful basis for transferring Personal Data and putting appropriate safeguards in place to ensure an adequate level of protection for the Personal Data. We will also ensure that the recipient in Alternate Country is obliged to protect your Personal Data at a standard of protection comparable to the protection under applicable laws.
Our lawful basis will be either consent (i.e. we may ask for your consent to transfer your Personal Data from your Home Country to the Alternate Country at the time you provide your Personal Data) or one of the safeguards permissible by laws.
VI. COOKIES AND ADVERTISING ON THIRD PARTY PLATFORMS
Additionally, we may share non-personally identifiable Personal Data with third parties, such as location data, advertising identifiers, or a cryptographic hash of a common account identifier (such as an email address), to facilitate the display of targeted advertising.
Disabling the collection of cookies on our websites
You may deactivate cookies by adjusting your internet browser settings to disable, block or deactivate cookies, by deleting your browsing history and clearing the cache from your internet browser.
Disabling the display of Targeted Ads through our App
You may be able to limit our use of your personal data to display advertisements that may be of relevance to you, by adjusting your preference sharing of some of this Personal Data through our Grab App (Settings > Privacy > Ads). You will still be seeing non targeted advertisements.
VII. PROTECTION OF PERSONAL DATA
We will take reasonable legal, organisational and technical measures to ensure that your Personal Data is protected. This includes measures to prevent Personal Data from getting lost, or used or accessed in an unauthorised way. We limit access to your Personal Data to our employees on a need to know basis. Those processing your Personal Data will only do so in an authorised manner and are required to treat your information with confidentiality.
Nevertheless, please understand that the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data transmitted through any online means, therefore, any transmission remains at your own risk.
VIII. YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA
In accordance with applicable laws and regulations, you may be entitled to:
Where you are given the option to share your Personal Data with us, you can always choose not to do so. If we have requested your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.
However, choosing not to share your Personal Data with us or withdrawing your consent to our use of it could mean that we are unable to perform the actions necessary to achieve the purposes of processing described in Section II (Use of Personal Data) or that you are unable to make use of the Services. After you have chosen to withdraw your consent, we may be able to continue to process your Personal Data to the extent required or otherwise permitted by applicable laws and regulations.
If you wish to make a request to exercise your rights, you can contact us through our contact details set out in Section X (How to Contact Us) below.
We will screen and verify all requests beforehand. In order to verify your authority to make the request, we may require you to provide supporting information or documentation to corroborate the request.
Once verified, we will give effect to your request within the timelines prescribed by applicable laws.
IX. AMENDMENTS AND UPDATES
Grab may modify, update or amend the terms in this Notice at any time. Such amendments shall be notified to you through the Application and/ or other appropriate means at least five (05) business days before the effective date. The updated version will be posted on the website http://www.grab.com. It is your responsibility to review the Privacy Noticeregularly. Your continued use of the Apps, Websites or Services, purchase products from Grab or continuing to communicate or engage with Grab following the modifications, updates or amendments to this Notice , whether or not reviewed by you, shall constitute your agreement to be bound by such amendments.
X. HOW TO CONTACT US
If you have any queries about this Notice or would like to exercise your rights set out in this Notice , please contact our Data Protection Officer at:
Grab Data Protection Officer
c/o Grab Holdings Inc.
6 Battery Road
For users in Philippines, please contact Grab at:
Name: GRAB Philippines Office
Address: 12th Floor, Wilcon IT Hub, Chino Roces Ave., 1233 Makati City
Contact Details: firstname.lastname@example.org (attention to: Dello Gervacio)
For users in Thailand, please contact Grab at:
Name: Grabtaxi (Thailand) Co., Ltd.
Address: UBC2 Tower, 591 Sukhumvit 33 Alley
Khlong Tan Nuea, Watthana
Bangkok 10110, Thailand
Contact Details: email@example.com
The original of this Notice is written in the English language. In the event of any conflict between the English and other language versions, the English version shall prevail.
ADDENDUM 1: GRAB FOR BUSINESS
This Addendum forms part of the Grab Privacy Notice . In the event of any inconsistency between the Grab Privacy Notice and this Addendum, this Addendum shall prevail.
II. GRAB’S RELATIONSHIP WITH USERS AND CLIENTS
How Grab for Business works
Grab for Business is provided as an add-on feature to facilitate corporate billing for the Authorised Users’ use of Grab’s Services in the course of work.
When an organisation (“Client”) chooses to utilise Grab for Business, the Authorised User is given the option of tagging his/her rides or other transactions to the Client or to tag it as a personal ride. An Authorised User is referred to in the Grab Privacy Notice as a passenger of driver partners.
As part of this feature, Grab will disclose detailed trip and booking information that Authorised Users have tagged as being for business purposes to the Client. Apart from this, Grab does not disclose other Personal Data of its Authorised Users to the Client.
Alternatively, an individual user may choose to set up a business profile within the App to facilitate the tagging of business-related rides and to generate consolidated trip reports to facilitate the submission of claims from his or her employer. When used in this mode, the claims process is user-driven and the user’s employer need not be a Client.
For ease of reference, Authorised Users and individual users will each be referred to as a “User” and collectively as “Users” in this Addendum.
Grab is a data controller, so are our Clients
In respect of any User and the processing of all their Personal Data (including but not limited to Linking Data and Portal Data), Grab acts as a data controller. For further information on how Grab collects, uses and discloses Users’ Personal Data, please refer to the Grab Privacy Notice .
Due to the way Grab for Business works, Grab does not process any Personal Data for and on behalf of the Client. Accordingly, Grab is not the data processor of the Client, but an independent data controller in respect of all Personal Data that it processes in the course of providing the Grab for Business feature. Likewise, the Client is an independent data controller of the Personal Data (e.g. the Linking Data and Portal Data) that it discloses to and/or receives from Grab.
III. WHAT PERSONAL DATA IS COLLECTED, PROCESSED AND DISCLOSED
What Grab collects as part of Grab for Business
In order to provide the Grab for Business feature, the individual user or the Client will be required to provide the following information about the Authorised User to Grab:
Grab will use this information for the purposes of:
Upon onboarding such User to the App, Grab will process the Personal Data of the User in accordance with the Grab Privacy Notice and this Addendum.
What Grab discloses to its Clients
Grab will disclose relevant trip and booking information as determined by Grab from time to time to the Client to facilitate Corporate Billing.
What Grab discloses to its individual user
Depending on the business profile settings selected by the individual user, the user may retrieve and generate reports containing his/her relevant trip and booking information.
IV. PARTIES’ OBLIGATIONS
The Client and Grab shall each:
● implement appropriate legal, technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against unauthorised loss, destruction, damage, alteration, or disclosure, as well as any breach or attempted breach of each party’s security measures (“Information Security Incident”).