Privacy Policy

Scope and accountability

This Policy explains how Mum Collective Ltd. collects, uses, discloses, retains and protects personal information about riders, drivers, applicants, passengers, vehicle users and other Platform users in Canada.

MUM's Privacy Officer is accountable for this Policy, privacy impact assessments, access and correction requests, complaints, vendor oversight and breach response.

A person may contact the Privacy Officer through the privacy request channel published in the Platform and beside this Policy.

Information collected

MUM collects only information reasonably required for an identified purpose, including:

• Account identity, contact details, authentication records and eligibility information.
• Driver applications, licence, authorization, work-eligibility, driving-record and legally required screening information.
• Vehicle ownership, VIN, registration, inspection, maintenance, claim, odometer and telematics information.
• Precise or approximate location, pickup, route, destination and time data.
• Ride requests, offers, acceptance, cancellation, fare, receipt, tip and support records.
• Payment tokens and limited payment metadata received from the payment processor.
• Earnings, payout, tax-reporting and Earn-to-Own Allocation Account information.
• Ratings, rider-driver blocks, complaints, safety reports, evidence and corrective-action records.
• Device, application, log, fraud, security, cookie and diagnostic information.
• Communications with support, including in-app messages and call metadata.
• Emergency contacts and SOS information used during an incident.
• Accommodation and accessibility information provided voluntarily or required to respond to a request.

MUM will not collect audio or video from an in-vehicle camera unless it adopts a separate recording assessment and notice identifying authority, field of view, audio status, access, retention and local signage requirements.

Sources of information

Information comes from the individual, the Platform, an approved vehicle, a driver or rider involved in a trip, payment and identity providers, screening agencies with authorization, insurers, regulators, municipalities, emergency services and lawful public or government records.

MUM will tell an individual when a material decision relies on information from another source and will provide a reasonable correction process, subject to lawful limits.

How information is used

MUM uses personal information to:

• Create and secure accounts.
• Verify eligibility, licensing, insurance, vehicle and safety requirements.
• Match, dispatch, navigate, complete and document rides.
• Calculate fares, payments, payouts, taxes, refunds and Ride Allocations.
• Provide receipts, support and account statements.
• Prevent fraud, account sharing, unsafe conduct and security incidents.
• Administer rider-specific no-match blocks.
• Investigate complaints and take fair safety or corrective action.
• Maintain, recover and transfer MUM Vehicles lawfully.
• Respond to emergencies and protect life or safety.
• Meet transportation, employment, tax, corporate, insurance and legal duties.
• Analyze aggregate service quality, demand and safety trends.
• Send marketing only with the consent required by Canada's anti-spam law.

MUM will not use a rider-specific block as proof of misconduct, sell precise trip or safety information, or use sensitive information for unrelated advertising.

Consent and other legal authority

MUM obtains meaningful consent where required and explains purposes in understandable language.

Some collection, use or disclosure may occur without consent where legislation permits or requires it, including specified investigations, emergencies, legal process and employment administration.

An individual may withdraw consent for an optional use on reasonable notice. Withdrawal does not invalidate prior lawful processing and may prevent a feature where the information is necessary to provide it.

Location and telematics

The Platform uses location while a driver is available, receives a Ride Offer, travels to pickup, completes a ride and performs incident or support functions.

A MUM Vehicle may transmit odometer, diagnostic, location, impact, security and maintenance data when disclosed in the Vehicle Use and Custody Agreement.

MUM will configure access by role, restrict routine staff from viewing live location without a service or safety need, record every privileged location access and disable collection that is not necessary for a stated purpose.

Telematics will not be used to intrude on private activity outside authorized use.

Asset-recovery location data is segregated from routine dispatch data and is subject to documented authorization and audit controls.

Rider-driver blocking and complaints

When a rider requests a no-match block, MUM records the two account identifiers, time, request category and implementation status.

The other account is not told who requested the block unless disclosure is required for a separate fair investigation.

A block suppresses every Platform match, assignment and manual dispatch for the identified rider and driver. It does not guarantee that the people will never encounter each other outside Platform matching.

The block does not permit discriminatory filtering and is not itself a misconduct finding. A separate safety allegation is recorded and investigated under the Driver Code of Conduct.

Disclosure and service providers

MUM may disclose the minimum necessary information to:

• A rider or driver to arrange and complete a ride.
• Stripe and approved payment, payout, identity and fraud providers.
• Hosting, communications, mapping, analytics, customer-support and security vendors.
• Screening agencies, vehicle service providers and insurers.
• Accountants, auditors and professional advisers under confidentiality duties.
• Transportation, tax, workers' compensation, law-enforcement, court, municipal or other authorities where required or lawfully requested.
• A buyer or successor in a properly controlled business transaction, subject to statutory conditions.

MUM maintains a vendor register identifying purpose, information classes, processing location, retention and contract controls. A vendor cannot use MUM information for its own unrelated purpose.

Processing outside Canada

Some providers may process information outside the province or Canada, where foreign courts, law-enforcement or national-security authorities may obtain lawful access.

MUM will identify material processing locations in its vendor register, assess safeguards, use contractual restrictions and make location information available through the privacy request channel.

Security safeguards

Safeguards must be proportionate to sensitivity and include:

• Role-based access.
• Multifactor authentication for privileged accounts.
• Encryption in transit and at rest where appropriate.
• Secure software practices.
• Vendor due diligence.
• Logging, backup and recovery.
• Personnel training.
• Incident response.
• Prompt access removal.

Passwords and payment credentials must not be sent through ordinary support messages.

Screening, health, safety, precise location and identity records receive heightened controls.

Retention schedule

MUM securely deletes, anonymizes or aggregates information when the stated period expires, unless a legal hold or longer mandatory period applies.

Access and correction

An individual may request access to the individual's personal information and an explanation of its use and disclosure, or request correction.

MUM verifies identity, searches reasonably, responds within the statutory period and explains any lawful withholding.

It will separate another person's information where reasonably possible rather than withholding the entire record.

If MUM refuses a correction, it will annotate the disputed information where required or appropriate and explain the complaint route.

Privacy breach response

Anyone who discovers suspected loss, unauthorized access or disclosure must immediately notify the Privacy Officer.

MUM will contain the incident, preserve evidence, assess sensitivity and probability of misuse, document its decision, notify affected individuals and regulators where the applicable threshold is met, and notify other organizations or government institutions where doing so may reduce harm.

Children and passengers without accounts

An account holder may request a ride involving a child only in accordance with MUM's eligibility, supervision and child-restraint rules.

MUM collects the minimum information needed for the ride and safety. A child who is not legally able to contract cannot create an account independently.

The account holder must not disclose unnecessary sensitive information about another passenger.

MUM will respond to a lawful access request by a parent, guardian or capable minor according to the applicable law and circumstances.

Automated decisions and analytics

MUM will not make a final employment, deactivation, fraud or serious safety decision solely from a rating, block or automated score without human review.

A materially affected person may request an explanation and correction of inaccurate input data.

Aggregate or de-identified analytics will be used where individual identity is unnecessary. MUM will assess re-identification risk before treating data as anonymous.

Marketing and communications

Transactional messages necessary for a ride, safety, account, receipt or legal notice are separate from marketing.

Commercial electronic messages will identify MUM, provide required contact information and contain a functioning unsubscribe mechanism.

MUM will implement an unsubscribe within 10 business days or any shorter applicable period.

Complaints and updates

MUM will acknowledge a privacy complaint promptly, investigate impartially and provide a written outcome and applicable regulator route.

An individual will not face retaliation for a good-faith request or complaint.

MUM may update this Policy prospectively when practices or law change, with prominent notice and new consent where a new purpose requires it.