Careem Rides Guidelines for Law Enforcement Authorities

Careem Rides is committed to continually improving the safety of our marketplace and contributing to safety in the communities where we operate. Law enforcement requests directed to Careem Rides are handled by a specialized team dedicated to working with law enforcement agencies, the Public Safety Response Team (“PSRT”). This team reviews and responds to each law enforcement request Careem Rides receives. The PSRT team has processes in place to assist law enforcement on a 24/7 basis, including emergency requests, through the Public Safety Portal or via email at lert@uber.com.

Careem Rides is also committed to the privacy of our users’ data. Careem Rides user data is stored and maintained as described in the Privacy Notice for Careem Rides, Terms and Conditions for Ridehailing Services, Uber Driver Services Agreement, and Uber’s Privacy Notice, as applicable. Careem Rides discloses data to law enforcement in accordance with applicable laws and Careem Rides’s core principles. This guide is not intended to provide legal advice. It also does not create any enforceable rights, and Careem Rides reserves the right to update or change this guide without notice to law enforcement.

Please note that these guidelines do not apply to Careem’s non-rideshare services. Any requests for non-rideshare user data should be directed to Careem Technologies via email at lert@careem.com.

Overview

Uber Technologies, Inc. (“UTI”) and Careem Deliveries FZ LLC are joint data controllers for all personal data of Careem Rides riders, and UTI is the sole data controller for all other data, including personal data of Careem Rides drivers (or “captains”). The PSRT team processes requests from law enforcement.

Upon receiving legal process or an emergency disclosure request, Careem Rides may disclose the requested data if doing so would be consistent with:

• applicable laws;
• Careem Ride’s core principles, as described below; and
• the Privacy Notice for Careem Rides, Terms and Conditions for Ridehailing Services, Uber Driver Services Agreement, and Uber’s Privacy Notice, as applicable.

Law enforcement should use the Portal as the primary means for contacting the PSRT. The Portal provides the central point of contact for law enforcement to communicate with PSRT specialists when submitting legal processor emergency disclosure requests. Law enforcement may also use the Portal to obtain status updates on submitted legal process or to ask questions. Only law enforcement and government personnel authorized to obtain evidence in connection with official legal proceedings may use the Portal. Portal accounts should be created using an official law enforcement or government email account.

The PSRT team can also be reached at lert@uber.com. Email requests must be submitted from an official law enforcement or government email account, and include the requesting law enforcement official’s name, title, badge number or similar identifier (if applicable), agency, and direct contact information.

Requirements for Legal Process and Emergency Disclosure Requests

When submitting any request to Careem Rides, law enforcement should identify the specific account(s) implicated by the request. When possible, law enforcement should provide a unique identifier associated with the account(s), such as email address, phone number, National Identity number and/or license plate number. Names alone often are not unique identifiers, nor are dates of birth (to the extent collected). Careem Rides may also be able to identify accounts that are relevant to a law enforcement investigation by searching for information related to a specific trip. For such requests, information about that trip, such as user identification information named above, and a date, time, booking ID, or pick up or drop off location, should be provided.

Legal process and emergency disclosure requests must be addressed to Uber Technologies, Inc. (UTI), 1725 3rd Street, San Francisco, CA 94158 and submitted via the Portal (or in the alternative, via lert@uber.com).

Legal Process

All law enforcement requests for data must be supported by legal process (with the exception of emergency requests, discussed below). Careem Rides reserves the right to reject legal process for any reason, including requests that do not have a valid legal basis, are overbroad, vague, or otherwise inappropriate, or if Careem Rides cannot verify the legitimacy of the request.

To be valid, legal process submitted to Careem Rides must generally:

• be addressed to Uber Technologies, Inc.;
• be issued in compliance with the local law of the requesting authority;
• be issued and signed by an appropriate authority, such as a judge;
• be dated;
• provide a date to return the responsive materials, if applicable; and
• specifically identify the targeted account(s), reasonably identified; the type(s) of information within the account to be disclosed; and any applicable date range.

Emergency Disclosure Requests

To the extent consistent with local law, Careem Rides may voluntarily disclose user data to a law enforcement entity if Careem Rides has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information related to the emergency. Requested data must be limited to data necessary to specifically address the ongoing emergency.

Emergency disclosure requests may be submitted via the Portal, or via email with an Emergency Disclosure Form attached. Because of its commitment to safety on its platform, Careem Rides has processes in place to respond to emergency requests on a 24/7 basis.

To submit an emergency disclosure request, law enforcement must:

• certify that they are authorized by law to obtain the requested records;
• certify that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency;
• state that there is a significant risk that the emergency may materialize if there is a delay caused by obtaining valid local legal process;
• specifically identify the targeted account(s), reasonably identified; the type(s) of information within the account to be disclosed; and any applicable date range; and
• if required by law, follow-up with legal process.

Careem Rides evaluates emergency disclosure requests on a case-by-case basis, including on an exigent basis, and will determine in its sole discretion whether to produce the sought-after data. Careem Rides may request additional information or documentation to aid in its evaluation of an emergency disclosure request.

Careem Rides’ User Notice Policy

Careem Rides may notify users of law enforcement requests for their data, unless notice is prohibited under applicable law.

As part of Careem Rides’ safety investigation procedures, Careem Rides may choose to contact an individual identified in a law enforcement request in connection with any alleged safety incident. Careem Rides will not initiate such contact if it reasonably believes, in its sole discretion, that such contact may:

• pose immediate risk of serious injury or death to a member of the public; or
• pervert the course of justice or prejudice the administration of justice.

When submitting a request, law enforcement may ask that Careem Rides not contact anyone associated with the request due to the foregoing reasons or other valid reasons as the case may be.

Careem Rides’ Core Principles

Careem Rides evaluates requests from law enforcement authorities with reference to Careem Rides’ core principles. Careem Rides may not disclose data if doing so would be inconsistent with those principles.

Careem Rides’ core principles for law enforcement requests include:

1. All requests must comply with applicable law, and be appropriately scoped.
2. Careem Rides will not enable real-time and ongoing access to precise and intact trip data by allowing unsupervised access into its internal systems.
3. Requests related to criminal investigations must relate to conduct that would constitute a crime under applicable law.
4. Local law must provide a mechanism for challenging legal process.