Cookie Notice

CARZOO — COOKIE NOTICE

Website, Applications and Marketplace Services

This Cookie Notice explains how CARZOO S.A.R.L. uses cookies, software development kits, pixels, local storage, device identifiers and similar technologies in connection with its website, mobile website, applications, booking services and automotive marketplace (collectively, the “Platform”).

Carzoo S.A.R.L. is a Lebanese limited liability company registered with the Beirut Commercial Register under number 2083036, with its registered office at Sheile, Rue 113, Blue Zone, Kesrouane, Lebanon (“Carzoo”, “we”, “us” or “our”).

This Notice is intended to provide additional information contemplated by Clause 23 of the CARZOO Terms and Conditions. It should be read together with the Terms and Conditions at carzooapp.com/terms and the Carzoo Privacy Notice at carzooapp.com/privacy.

1. SCOPE AND LEGAL FRAMEWORK

This Notice applies when a visitor or User accesses or uses the Platform through a browser, mobile device, application or other connected interface. It applies whether the person creates an account or completes a Booking.

To the extent that information collected through these technologies constitutes Personal Data, Carzoo processes it in accordance with applicable Lebanese law, including Lebanese Law No. 81/2018 on Electronic Transactions and Personal Data, the Carzoo Privacy Notice and any other law that mandatorily applies to the relevant activity or person.

Where applicable law requires consent or another affirmative choice before a technology may be stored, accessed or activated, Carzoo will seek that choice through the Platform before using the relevant optional technology.

2. WHAT COOKIES AND SIMILAR TECHNOLOGIES ARE

A cookie is a small text file placed on or read from a browser or device when a website is visited. A session cookie ordinarily expires when the browser session ends. A persistent cookie remains until its stated expiry, until it is replaced, or until the User deletes it.

First-party cookies are set by or for Carzoo on the Platform. Third-party cookies are set by another provider whose technology or content is used through the Platform.

Similar technologies may include:

·  local storage and session storage used by a browser or application;

·  software development kits (“SDKs”) integrated into a mobile application;

·  pixels, tags, scripts and web beacons that record whether a page, screen, message or feature was accessed;

·  device, application, advertising and installation identifiers; and

·  push-notification tokens, fraud-prevention identifiers and comparable technical signals.

References to “Technologies” in this Notice include cookies and all such similar technologies.

3. INFORMATION THESE TECHNOLOGIES MAY COLLECT

Depending on the Technology and the way the Platform is used, the information collected may include:

·  IP address, approximate location derived from the IP address, language and time zone;

·  device type, operating system, browser type, application version and technical configuration;

·  unique cookies, session, installation, application or device identifiers;

·  the date and time of access, referring page or source, pages and screens viewed, links selected and features used;

·  search, availability, vehicle-category, location and Booking-flow events;

·  authentication, security, error, performance and fraud-prevention information;

·  · advertising and campaign-interaction information, including referral sources, advertising campaign identifiers, advertising click identifiers, URL tracking parameters, page views, rental searches, vehicle-listing interactions, checkout initiation, Booking conversion events, Booking identifiers and transaction values, where the relevant optional Technology is enabled and the required consent has been provided;

·  the User’s consent and cookie-preference record.

4. CATEGORIES AND PURPOSES

4.1 Strictly necessary Technologies

These Technologies are required to provide a function expressly requested by the User or to operate and protect the Platform. They may support secure sessions, authentication, account access, load balancing, network management, Booking and checkout functions, fraud prevention, security, error recovery and storage of the User’s privacy choices. To the extent permitted by applicable law, they may operate without an optional preference because disabling them may prevent the relevant service from functioning.

4.2 Preference and functionality Technologies

These Technologies remember choices such as language, location preferences, saved searches, display settings or other optional conveniences. Disabling them may cause the Platform to forget those choices or reduce personalized functionality.

4.3 Analytics and performance Technologies

These Technologies help Carzoo understand how the Platform is used, identify errors, measure traffic and feature performance, improve navigation and evaluate service reliability. Carzoo will not classify an analytics Technology as strictly necessary merely because the resulting information is commercially useful.

4.4 Advertising and campaign-measurement Technologies

Carzoo uses advertising and campaign-measurement Technologies to understand how Users interact with advertisements and whether those interactions lead to visits, rental searches, vehicle-listing views, checkout activity and Bookings.

These Technologies include:

Google Ads: Used to measure advertising conversions, attribute Bookings to Google advertising campaigns and evaluate campaign performance.

Meta Pixel (Facebook and Instagram): Used to measure website visits, rental searches, vehicle-listing views, checkout initiation and successful Booking creation in connection with Meta advertising campaigns.

OpenAI Ads Pixel (ChatGPT): Used to measure supported advertising conversion events, including successful Booking creation, in connection with advertising displayed through ChatGPT.

Depending on the Technology, information processed may include advertising click identifiers, cookie identifiers, campaign information, page addresses, interaction events, event timestamps, Booking identifiers and transaction values.

For advertising measurement, Carzoo may record a conversion when a Booking is successfully created on the Platform, including where the Booking remains subject to confirmation by the relevant Rental Company.

A recorded advertising conversion does not necessarily mean that the rental has been completed or that Carzoo has received the full rental payment.

These optional advertising Technologies are activated only after the User provides Advertising consent through the Platform's cookie preferences, where required by applicable law.

Carzoo does not intentionally transmit complete payment-card details, passwords, driving-license documents or other unnecessary sensitive Personal Data through advertising conversion events.

Advertising providers may process information received through their Technologies under their applicable privacy notices and contractual arrangements.

Where the User has provided the required Advertising consent, the OpenAI Ads Pixel may automatically detect certain contact information entered into Platform forms, such as email addresses and telephone numbers, and convert that information into hashed identifiers before transmitting it to OpenAI for advertising conversion matching and measurement. Hashed identifiers may still constitute Personal Data. This processing helps Carzoo understand which advertising interactions lead to Bookings and improve advertising performance.

5. FIRST-PARTY AND THIRD-PARTY PROVIDERS

Some Technologies are controlled by Carzoo. Others may be provided by hosting, security, payment, analytics, communications, customer-support, mapping, fraud-prevention, advertising or social-media providers.

A third-party provider may receive identifiers, device information and interaction events directly from the User’s browser or application and may process that information under its own privacy or cookie notice where it determines its own purposes and methods. Carzoo will identify the relevant provider and link to available provider information in the Schedule below where reasonably practicable.

Use of a third-party Technology does not authorize the provider to use Carzoo Booking or customer information for unrelated purposes contrary to CARZOO’s contractual restrictions or applicable law.

6. USER CHOICES AND COOKIE SETTINGS

A User may review or change available choices at any time by selecting “Cookie Settings” in the Platform footer. Necessary Technologies are always active because they are required to provide or secure core Platform functionality. Functionality, Analytics and Advertising Technologies are optional and, where consent is required, will not be activated unless the User enables the relevant category.

Withdrawing a choice will apply prospectively and will not affect processing lawfully carried out before the change. Where technically practicable, Carzoo will remove Carzoo-controlled optional cookies or similar storage associated with a category after the User withdraws the relevant choice. In particular, Google Ads, Meta Pixel and OpenAI Ads tracking technologies will only be activated where the User has provided the required Advertising consent. If Advertising consent is withdrawn, Carzoo will stop initiating new optional advertising tracking events and will remove associated Carzoo-controlled identifiers where technically practicable. Information already lawfully transmitted to advertising providers may remain subject to those providers' applicable retention practices and privacy notices.

Carzoo stores the User's cookie preferences on the relevant browser or device for 12 months. If that preference record expires or is deleted, the Platform will ask the User to make a new selection.

7. BROWSER, DEVICE AND MOBILE-APPLICATION CONTROLS

Most browsers allow Users to view, block or delete cookies and to restrict third-party cookies. Browser controls vary by provider and version. Blocking all cookies may prevent account login, secure sessions, Booking checkout or other requested functions.

Browser settings do not necessarily control mobile SDKs, application storage, push-notification tokens or device advertising identifiers. Technologies may be controlled through the Platform’s settings, the mobile operating system, device permissions or the relevant provider’s controls.

8. DURATION AND RETENTION

Session Technologies generally expire when the relevant browser or application session ends. Persistent Technologies remain for the exact duration stated in the Schedule, unless the User deletes them earlier or they are replaced.

Carzoo will not retain a Technology or the Personal Data obtained through it for longer than reasonably necessary for its identified purpose or any period required or permitted by applicable law. Server-side records created from Technology events may have a different retention period stated in the Privacy Notice or Carzoo’s internal retention schedule.

9. SECURITY, DATA MINIMIZATION AND INTERNATIONAL PROCESSING

Carzoo will take reasonable technical and organizational measures appropriate to the nature of the information and the risks of the relevant processing. Carzoo will configure Technologies to collect only information reasonably necessary for their stated purposes and will restrict service-provider access according to role and need.

A provider may operate or access data from outside Lebanon. The relevant countries, recipients and safeguards must be addressed in the Carzoo Privacy Notice and where useful for transparency, identified in the Schedule below.

10. CHANGES TO THIS NOTICE

Carzoo may update this Notice to reflect changes to the Platform, Technologies, providers, legal requirements or operational practices. The updated Notice and its effective date will be made available on the Platform.

A material change to an optional Technology or its purpose will not override an existing User choice where applicable law requires a new notice or renewed choice.

11. CONTACTS, COMPLAINTS AND LANGUAGE

Responsible entity: CARZOO S.A.R.L.

Commercial Registration: Beirut Commercial Register No. 2083036

Registered office: Sheile, Rue 113, Blue Zone, Kesrouane, Lebanon

Website: carzooapp.com

Privacy and cookie enquiries: privacy@carzooapp.com

Customer Support: help@carzooapp.com | Telephone/WhatsApp: +96171000438

Questions or complaints may be submitted using the details above. This does not affect any right to apply to a competent Lebanese court or authority where the matter falls within its jurisdiction.

This Notice is issued in English and Arabic, and both versions are intended to have the same meaning. If an inconsistency cannot reasonably be reconciled, the Arabic version prevails to the extent permitted by applicable law.