How we handle your personal data

Vybe Cabs (OPC) Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at Ripple HQ — Ivy Lake, Gate 1, 941/1, Hulimavu Main Rd, off Bannerghatta Road, Muneshwara Block, Hulimavu, Bengaluru, Karnataka 560076 (“Vybe Cabs”, “the Company”, “we”, “our”, or “us”), is committed to protecting the privacy, confidentiality and integrity of personal data belonging to all individuals who interact with us — including Riders, Drivers and driver-applicants, corporate users and employees availing Employee Transportation Services, visitors to our website, platform or business portals, and the corporate customers, business partners, vendors, service providers and fleet operators with whom we work, together with their employees, authorised representatives and personnel (collectively, “Users” or “Data Principals”).

This Privacy Policy (“Policy”) describes the nature and purpose of the personal data we collect, how we process and safeguard it, the conditions under which we may share it, and the rights and choices available to Users, whether they engage with Vybe Cabs directly through the Vybe Platform (our mobile application, website and related digital services) or through a business-to-business (“B2B”) relationship as a corporate customer or business associate.

This Policy is framed with reference to the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the rules made thereunder (“DPDP Rules”), the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and other applicable Indian laws, and is published in accordance with Rule 4 of the SPDI Rules. This Policy should be read together with Vybe Cabs' Terms & Conditions, Cancellation and Refund Policy, Grievance Redressal Policy, and any applicable service agreement, corporate transportation agreement, vendor agreement or data processing agreement entered into with Vybe Cabs.

01Definitions and Interpretation

For the purposes of this Policy, unless the context otherwise requires:

• “Board” means the Data Protection Board of India constituted under the DPDP Act.
• “Data Fiduciary” means the person who, alone or in conjunction with others, determines the purpose and means of processing personal data. Vybe Cabs acts as a Data Fiduciary in respect of personal data it processes for its own purposes, and may act as a joint Data Fiduciary or a Data Processor in respect of personal data processed on behalf of a corporate customer, depending on the nature of the engagement.
• “Data Principal” or “User” means the individual to whom the personal data relates, including Riders, Drivers and driver-applicants, corporate users and employees, visitors, and the employees, representatives and personnel of corporate customers, vendors and business partners.
• “Data Processor” means any person who processes personal data on behalf of a Data Fiduciary.
• “Personal data” means any data about an individual who is identifiable by or in relation to such data.
• “Processing” means any operation performed on personal data, including collection, recording, organisation, storage, use, sharing, transmission, erasure or destruction, whether wholly or partly by automated means.
• “Sensitive Personal Data or Information” or “SPDI” shall have the meaning assigned to it under Rule 3 of the SPDI Rules, and includes passwords, financial information such as bank account, payment card or other payment instrument details, physical, physiological or mental health condition, biometric information, and any information received for processing, stored or processed by Vybe Cabs under a lawful contract, to the extent such categories are collected in connection with our services.
• “Significant Data Fiduciary” or “SDF” means a Data Fiduciary notified as such by the Central Government under Section 10 of the DPDP Act, based on factors such as volume and sensitivity of personal data processed, risk to Data Principals, and other prescribed criteria.
• “Vybe Platform” means Vybe Cabs’ mobile application, official website, and any related digital services owned or managed by Vybe Cabs.

02Scope and Applicability

This Policy applies to all natural and legal persons who engage with Vybe Cabs in any form, including:

• Riders who use the Vybe Platform to book, schedule, or manage transportation and mobility services;
• Drivers and driver-applicants who register on the Vybe Platform for professional engagement or verification;
• Corporate customers and authorised representatives availing Employee Transportation Services (ETS) or B2B mobility services, and their employees, passengers and other personnel;
• Vendors, service providers, fleet owners and other business associates of Vybe Cabs, and their personnel; and
• Visitors accessing the Vybe Cabs website, platform or business portals, or communicating with us through digital or offline channels.

This Policy governs the collection, use, disclosure, storage, and protection of personal data processed during registration, booking, scheduling and payment transactions; driver enrolment, background verification and identity validation; corporate account management and corporate booking; commercial discussions, contracts and business transactions; communications between Users and Vybe Cabs; billing and reporting; and analytical, statistical and security operations that enable platform functionality. It applies to personal data relating to identifiable individuals, whether collected directly by Vybe Cabs or provided by a corporate customer or employer, and does not generally apply to information relating exclusively to legal entities, anonymised information or aggregated data that cannot reasonably identify an individual.

03Personal Data We Collect

Depending on the nature of the relationship, Vybe Cabs may collect and process the following categories of personal data, strictly to the extent necessary and lawful:

3.1 Identification and Contact Information

Full name, date of birth or age, gender, contact details (email and phone number), account credentials, designation, company or organisation name, business or office address, department, optional profile data such as photographs and language preferences, emergency contact details, and saved addresses (such as “Home” or “Work”).

3.2 Identity and Safety Verification Data

Drivers: driving licence, Aadhaar, PAN, vehicle registration, insurance papers, bank account details for payouts, and live “selfie” captures for identity matching. Riders and corporate personnel: basic identity and contact confirmation where applicable, and corporate or employee identification details, where required. Vybe Cabs may periodically re-verify these details to maintain safety standards and prevent impersonation.

3.3 Booking, Trip and Location Data

Pickup and drop-off locations, travel dates and times, passenger and travel details, booking and trip history, trip schedules, and real-time or historical GPS and vehicle location tracking, route and destination information, and trip duration, captured during active service usage (for Riders, from ride request to completion; for Drivers, throughout active duty sessions) and disabled automatically after logout or inactivity, essential for ride matching, navigation, safety monitoring, operational coordination and emergency response.

3.4 Payment, Billing and Transaction Data

Payment method type (such as card, UPI or wallet details, processed securely through authorised payment gateways such as Razorpay in compliance with RBI and PCI-DSS regulations), transaction identifiers, fare amounts, refunds, billing addresses, invoice and corporate billing details, tax information, payment status, and other records necessary for accounting, auditing or contractual purposes. Vybe Cabs does not store complete card, CVV or UPI PIN information, or other sensitive payment credentials, except where required and permitted under applicable law and handled through authorised payment service providers.

3.5 Communication Records

In-app chats, masked calls, customer support interactions, business correspondence, complaints, feedback and survey responses, and other communications exchanged with Vybe Cabs. Certain calls and messages may be recorded for safety, quality assurance and dispute resolution purposes, with users notified beforehand where applicable. Dash cameras are not currently in use.

3.6 Corporate and Organisational Data

Corporate account details, employee or authorised user details, aggregated trip reports, subscription details, route analytics, and other information reasonably necessary for a corporate customer to avail Employee Transportation Services or other B2B mobility services.

3.7 Technical and Usage Data

Device type and model, operating system, unique device identifiers, IP address, browser type, carrier and network information, login information, usage logs, crash diagnostics, platform activity and security logs, and cookies and similar technologies, collected to ensure compatibility, security and performance optimisation.

3.8 Information from Third Parties

Vybe Cabs may supplement collected information with verified data from payment gateways (such as Razorpay) for transaction verification; navigation providers (such as Google Maps) for location accuracy and route guidance; cloud and hosting partners (such as AWS and Firebase) for secure data storage and analytics; corporate employers or institutions for employee verification; and government or law enforcement agencies, only under lawful order or investigation.

04How We Collect Personal Data

Vybe Cabs may collect personal data directly from the relevant individual; from corporate customers or employers; from authorised representatives; through our website, applications or business platforms; during the performance of transportation services; from vendors, fleet partners or service providers; through communications and business interactions; or from publicly available sources or third parties where permitted under applicable law. Where a corporate customer provides personal data relating to its employees, representatives or other individuals to Vybe Cabs, the corporate customer shall be responsible for ensuring that it has the necessary authority, notice, consent or other lawful basis required under applicable law for such disclosure and processing.

05Purpose and Lawful Basis of Processing

Vybe Cabs collects and processes personal data strictly for lawful, specific and legitimate purposes, including:

• Registration and verification: creating and managing user and corporate accounts, validating identities, and preventing duplicate or fraudulent profiles;
• Trip facilitation: matching Riders with Drivers, assigning vehicles, estimating fares, and processing bookings efficiently;
• Payment and billing: managing secure digital transactions, invoicing, refunds, and corporate billing;
• Safety and security: GPS-based monitoring, SOS support, incident response, and protecting passengers, drivers and vehicles;
• Customer and business support: managing user and corporate enquiries, service requests, and complaint redressal;
• Fraud prevention and compliance: verifying users and authorised representatives, detecting and preventing fraud, misuse or unauthorised access, and enforcing contractual and legal rights;
• Business relationship management: communicating with corporate customers and business partners, managing contracts, and conducting business meetings and negotiations;
• Analytics and improvement: monitoring performance, studying usage trends, and developing new features and services;
• Legal and regulatory compliance: fulfilling statutory obligations under motor vehicle, taxation, transport and data protection laws, responding to lawful directives, and maintaining records for audits and dispute resolution; and
• Marketing and rewards (future feature): with consent, informing Users of offers, loyalty benefits or service expansions, always with an option to opt out.

No data is collected for purposes that are unlawful, excessive, or unrelated to service delivery. Data processing at Vybe Cabs is founded on explicit consent obtained during registration or authorised by a corporate customer, as well as on legitimate business necessity and legal compliance obligations.

Where consent is the basis of processing, Vybe Cabs or the relevant corporate customer, as applicable, shall provide a clear and itemised notice, in plain language, describing the personal data to be collected and the purpose of processing, prior to or at the time of seeking consent, and shall obtain free, specific, informed, unconditional and unambiguous consent through an affirmative action. Where the personal data collected constitutes SPDI, such consent shall additionally be obtained in writing (including by letter, fax or email), as required under Rule 5 of the SPDI Rules.

Personal data may also be processed without consent, where permitted under Section 7 of the DPDP Act, including where necessary for: the specified purpose for which the Data Principal has voluntarily provided personal data and has not indicated any objection; performance of a contract to which the Data Principal is a party (including corporate service agreements); compliance with any judgment, decree, order, or applicable legal obligation; responding to a medical emergency or ensuring safety during a disaster or public health emergency; employment-related purposes, subject to applicable conditions; and other legitimate uses permitted under applicable law.

Users may withdraw consent at any time by adjusting in-app settings or sending a written request; doing so may limit access to core features or prevent Vybe Cabs from offering certain services.

06Emergency Processing of Personal Data

Notwithstanding anything contained in this Policy, Vybe Cabs may process personal data, including location, contact and trip information, without the consent of the Data Principal, where necessary to respond to a medical emergency involving a threat to life or immediate health of a passenger, driver or other individual; provide medical treatment or health services during an epidemic, outbreak of disease, or other threat to public health; or ensure the safety of, or provide assistance to, an individual during a disaster or breakdown of public order. For those purposes, Vybe Cabs may share relevant personal data with hospitals, medical personnel, emergency services, law enforcement authorities, and the Data Principal's designated emergency contact, strictly to the extent necessary to respond to the emergency, in accordance with Section 7(f)–(h) of the DPDP Act.

07Corporate Customer Responsibilities

Where a corporate customer provides Vybe Cabs with personal data relating to its employees, passengers, representatives or other individuals, the corporate customer agrees and acknowledges that it shall: have the necessary authority to provide such personal data; provide appropriate privacy notices to relevant individuals; obtain consent where required by applicable law; ensure that the personal data shared is accurate and reasonably necessary for the intended purpose; and notify Vybe Cabs of any relevant correction, withdrawal of consent or restriction applicable to the personal data, where required. The parties may enter into a separate Data Processing Agreement (“DPA”) where required, based on the nature and extent of personal data processing, including allocation of responsibilities between the corporate customer and Vybe Cabs as Data Fiduciary, joint Data Fiduciary or Data Processor, as applicable.

08How We Use Your Information

In addition to the purposes set out in Section 5, Vybe Cabs uses personal data to: enable Users to register, log in and access their accounts; connect Riders with suitable Drivers using automated algorithms based on proximity and availability; authenticate Driver identity using facial verification or document rechecks; monitor trip progress through live GPS tracking and identify unusual or risky behaviour such as route deviations, multiple cancellations or fake accounts; provide booking updates, reminders, service alerts and policy notifications; perform data analytics to improve route efficiency, pricing algorithms and platform content; and introduce and personalise new services based on historical usage.

09Data Sharing and Disclosure

Vybe Cabs maintains a strict non-disclosure and non-sale policy regarding personal data. The Company does not sell, rent, lease, or commercially trade any personal information to third parties for profit or marketing. Data sharing occurs solely under controlled, lawful, and clearly defined circumstances that are essential for service delivery, safety, regulatory compliance, or with explicit consent, and may include the following:

9.1 Corporate Customers and Authorised Representatives

Relevant booking, trip, passenger, billing, GPS and service information may be shared with a corporate customer and its authorised representatives, to the extent necessary for travel administration, employee transportation management, safety, billing, reporting, dispute resolution and contractual purposes.

9.2 Drivers, Riders and Transportation Partners

Information necessary to perform transportation services may be shared with drivers, fleet owners and authorised transportation partners, including passenger name, pickup location, destination, contact information and trip-related instructions. Vybe Cabs also enables limited information sharing between Riders and Drivers to facilitate rides safely: Riders receive the Driver's name, vehicle model, registration details, profile rating, and a masked contact number; Drivers receive the Rider's first name, pickup and drop-off locations, and a masked phone number. This exchange is limited to the duration of the trip and automatically restricted thereafter; direct contact details are never disclosed without consent. Riders and Drivers are strictly prohibited from storing, sharing or using this exchanged information for any purpose other than ride facilitation, and violation may result in suspension, account termination, or legal proceedings.

9.3 Technology and Service Providers

Vybe Cabs may share information with authorised third-party service providers engaged for technology infrastructure and cloud hosting (such as AWS), analytics (such as Firebase and Google Analytics), navigation (such as Google Maps), payment processing (such as Razorpay, in compliance with RBI and PCI-DSS standards), customer support, professional advisory services, security, and other operational support. Such providers are contractually bound to process personal data only for authorised purposes, strictly per Vybe Cabs' instructions, and subject to appropriate confidentiality and security obligations. Vybe Cabs conducts periodic audits, access logging and system monitoring of these integrations, and any vendor found non-compliant or negligent in data handling may be subject to immediate suspension or termination of engagement.

9.4 Government and Regulatory Authorities

Vybe Cabs may disclose personal data where required under applicable law, court order, regulatory requirement or lawful request from a competent government, regulatory or law enforcement authority, including the Board, made after verifying the authenticity of the request and ensuring due process of law.

9.5 Trip and Vehicle Recordings

Where trip-related recordings are generated in connection with the services, including live GPS or trip logs and call or communication recordings, Vybe Cabs may share relevant recordings with a corporate customer, insurers, authorised investigators, and government, regulatory or law enforcement authorities, where necessary for safety incidents, accidents or claims investigation, insurance processing, fraud prevention, dispute resolution or compliance with applicable law.

9.6 Corporate, Structural and Business Transfers

In the event of a merger, acquisition, investment, restructuring, sale of assets, financing or similar corporate transaction, relevant personal data may be transferred or disclosed to the acquiring or succeeding entity, subject to applicable legal and contractual requirements and under equivalent contractual and privacy safeguards.

9.7 Sharing Based on Consent

Vybe Cabs may, from time to time, share limited data with verified partners such as loyalty programme providers, insurers, or affiliates, only with explicit consent. Users will be informed of the purpose, extent and duration of such sharing and may opt out at any stage. Vybe Cabs will not condition access to essential services on consent for non-essential data sharing.

10Cross-Border Data Transfers

At present, personal data collected by Vybe Cabs is collected, processed and stored within India, specifically on secure servers located in Bengaluru, Karnataka, in controlled data centres compliant with international security standards. Vybe Cabs may, now or in the future, process or store personal data using service providers or technology infrastructure located outside India. Any such transfer will occur only to jurisdictions with adequate data protection standards comparable to Indian law, will be governed by binding contractual clauses ensuring continued protection, confidentiality and lawful use of data, and will be undertaken in accordance with the DPDP Act, save that the Central Government may restrict transfer of personal data to specific countries or territories by notification, which Vybe Cabs will comply with as and when notified. Users will be duly notified prior to the commencement of any such transfer, and Vybe Cabs remains fully responsible for ensuring that any offshore processor or cloud partner upholds equivalent levels of data privacy and security.

11Data Storage, Retention and Security

Vybe Cabs implements reasonable technical, organisational and administrative measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, destruction and other unlawful processing. These measures may include access controls, authentication mechanisms (including multi-factor authentication for administrative operations), encryption of data in transit using industry-standard SSL/TLS protocols, secure data storage with limited access rights, system and access monitoring, employee confidentiality obligations, and periodic security assessments and audits. Passwords and tokens are never stored in plain text. In accordance with Section 43A of the IT Act and Rule 8 of the SPDI Rules, Vybe Cabs implements and maintains reasonable security practices and procedures comparable to internationally accepted standards such as IS/ISO/IEC 27001 or an equivalent industry standard, with its security programme documented and subject to periodic review and audit.

Personal data is retained only for as long as reasonably necessary to provide services, manage business relationships, complete transactions, maintain operational and financial records, meet legal, regulatory and tax obligations, resolve disputes, and enforce or establish legal claims. For active Users, data remains stored throughout the active service period; for deleted accounts, data is retained for 30 days post-deletion to allow reactivation or dispute resolution; and certain regulatory records, such as tax invoices, trip logs and payment confirmations, are retained for longer durations where required by law. Upon expiry of the applicable retention period, personal data is deleted, anonymised or securely archived in a manner that prevents re-identification, subject to applicable legal requirements including any retention schedule prescribed under the DPDP Rules.

However, no method of electronic transmission or storage is completely secure, and Vybe Cabs cannot guarantee absolute security of personal data.

12Sensitive Personal Data or Information

Where Vybe Cabs collects or processes SPDI (such as financial or payment information), Vybe Cabs shall, in addition to its other obligations under this Policy:

• Collect SPDI only where necessary for a lawful purpose connected with a function or activity of Vybe Cabs, and only to the extent considered necessary for that purpose;
• Obtain consent in writing (including by letter, fax or email) from the relevant Data Principal, or ensure that the relevant corporate customer has obtained such consent, prior to collection of SPDI, as required under Rule 5 of the SPDI Rules;
• Permit a Data Principal, upon request, to review the SPDI provided and have it corrected or amended, to the extent held by Vybe Cabs;
• Provide Data Principals the option to not provide the SPDI sought, and to withdraw consent previously given, subject to the consequences of such withdrawal or non-provision being explained;
• Not retain SPDI for longer than is required for the purpose for which it was collected, or as otherwise permitted or required under applicable law; and
• Not disclose SPDI to a third party without the consent of the relevant Data Principal or corporate customer, except where disclosure is necessary to comply with a legal obligation, or has been agreed under a lawful contract.

13Data Principal / User Rights

Subject to applicable law, Data Principals whose personal data is processed by Vybe Cabs have the following rights under the Digital Personal Data Protection Act, 2023:

• Right to access: to obtain confirmation of whether Vybe Cabs holds their personal data, and a copy or summary of such information and the processing activities undertaken;
• Right to correction and erasure: to request correction, completion, updating or deletion of personal data, subject to applicable legal and contractual obligations (such as tax or dispute records);
• Right to grievance redressal: to have a readily available means to register a grievance with Vybe Cabs regarding the processing of personal data;
• Right to nominate: to nominate another individual to exercise these rights in the event of death or incapacity; and
• Right to withdraw consent: where processing is based on consent, at any time, with the same ease with which consent was given.

Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal, and Vybe Cabs may continue to retain or process personal data thereafter to the extent required or permitted under applicable law; withdrawal or deletion may also render certain platform functionalities unavailable, including active bookings, payment history or trip records. Vybe Cabs will not discriminate against a User for exercising these rights, though essential processing required for service continuity may remain unaffected.

14Significant Data Fiduciary Obligations

If Vybe Cabs is notified by the Central Government as a Significant Data Fiduciary under Section 10 of the DPDP Act, Vybe Cabs shall, in addition to its other obligations under this Policy, to the extent applicable: appoint a Data Protection Officer based in India, who shall represent Vybe Cabs for the purposes of the DPDP Act and be responsible to its Board of Directors or equivalent governing body; appoint an independent data auditor to carry out periodic data audits of its processing activities; conduct periodic Data Protection Impact Assessments and periodic compliance audits; and comply with any additional obligations relating to algorithmic accountability or restrictions on cross-border transfer of personal data as may be prescribed. This Policy will be updated to reflect the contact details of the Data Protection Officer if and when Vybe Cabs is designated a Significant Data Fiduciary.

15User Controls and Preferences

Users may access their privacy dashboard or account settings through the Vybe Platform to manage or update personal information (such as name, contact, and saved addresses); modify notification, SMS and email preferences; review active ride history and associated data; and deactivate or delete their account permanently. Should Vybe Cabs introduce promotional offers or marketing campaigns in the future, all such communications will be sent only to consenting Users, and each message will contain an opt-out or “unsubscribe” link. Transactional push notifications — including ride updates, payment confirmations and safety alerts — are integral to service functionality; non-essential push notifications can be disabled through device settings, while critical ride-related notifications (such as SOS alerts, driver arrival, or payment issues) will remain active.

16Children and Minors

Vybe Cabs’ services are primarily intended for users aged 18 years and above. Users aged between 16 and 17 years may access select services, provided that their parent or legal guardian grants verifiable consent and assumes full legal and financial responsibility for all actions, communications or transactions undertaken by the minor on the Vybe Platform. Vybe Cabs does not knowingly collect or process data from individuals under 16 years of age; if such data is inadvertently obtained, it will be immediately deleted upon discovery or upon verified request by a parent or guardian, who may contact support@vybecabs.com for this purpose.

17Cookies and Analytics

Vybe Cabs uses cookies, SDKs and similar technologies to recognise repeat users and maintain login sessions; retain personalised preferences such as default addresses or language settings; analyse platform interaction, feature usage and navigation patterns; detect fraudulent activity or unauthorised access attempts; maintain platform security; and enhance performance and operational efficiency. These include Essential Cookies (core functionality, security and authentication), Performance Cookies (analytics, crash diagnostics and service improvement), Preference Cookies (user-selected settings), and third-party Analytics Tools such as Firebase and Google Analytics, which track aggregated performance metrics used exclusively for service improvement and not for advertising or profiling. Users may adjust or disable non-essential cookies through browser or device settings; disabling essential cookies may affect functionality such as automatic login or saved preferences.

18Third-Party Services

Vybe Cabs’ platforms may contain links to or integrations with third-party websites, platforms or services. Vybe Cabs is not responsible for the privacy practices, content or security of third-party services, and Users are encouraged to review the privacy policies of relevant third parties before providing personal data.

19Data Breach and Incident Response

Vybe Cabs maintains a documented Incident Response Framework for identifying, reporting and addressing potential data breaches, consistent with reasonable security practices and procedures under Section 43A of the IT Act. In the event of a suspected or confirmed breach, Vybe Cabs will: isolate affected systems and disable compromised credentials (containment); assess the cause, scope and potential impact (investigation); notify the Board of a personal data breach in the manner and within the timelines prescribed under the DPDP Rules, and notify each affected Data Principal without delay, describing the nature, extent, timing and likely impact of the breach and the measures taken to mitigate risk; implement corrective actions such as patching vulnerabilities and revising procedures (remediation); and maintain an internal incident report for compliance and audit purposes (documentation). Where a breach relates to personal data shared by a corporate customer, Vybe Cabs will additionally notify the affected corporate customer promptly to enable it to fulfil its own notification obligations, if any, under applicable law or contract. All breach-related actions are performed in alignment with CERT-In guidelines and the DPDP Act, and, where applicable, Vybe Cabs will communicate directly with affected Users to advise on protective steps such as password resets.

20No Transfer of Ownership of Personal Data

Nothing in this Policy shall be interpreted as transferring ownership of personal data from one party to another. Each party shall process personal data only to the extent necessary for the purposes of the relevant relationship and in accordance with applicable law and contractual obligations.

21Governing Law and Dispute Resolution

This Policy shall be governed by, interpreted and enforced in accordance with the laws of India, subject to the jurisdiction of the courts in Bengaluru, Karnataka, and any separate contractual dispute resolution mechanism agreed between Vybe Cabs and a business customer. Users or corporate customers with privacy-related disputes or grievances must first contact Vybe Cabs’ Grievance Redressal Team via the official support channels. If a User's grievance remains unresolved beyond 15 business days, the matter may be escalated to the competent Consumer Dispute Redressal Authority under the Consumer Protection Act, 2019, or to the Data Protection Board of India under the DPDP Act. Where mutually agreed, Vybe Cabs and a User or corporate customer may elect to resolve disputes through arbitration in Bengaluru, in accordance with the Arbitration and Conciliation Act, 1996, and the arbitral award shall be final and binding.

22Policy Updates

Vybe Cabs reserves the right to modify, update, or replace this Policy at any time to reflect changes in applicable laws, our business operations, technology, our services, or privacy and security practices. Updates will be published on the official Vybe Cabs website and mobile application; for significant changes impacting User rights, Vybe Cabs will provide clear notice through email, SMS or in-app notification. Continued use of Vybe Cabs’ services, or continued performance of a B2B service agreement, after an updated version is published constitutes acknowledgment and acceptance of the revised Policy. Vybe Cabs maintains an internal record of policy versions and modification dates for compliance, audit and reference. The “Last Updated” date above indicates the most recent revision.

23Grievance Redressal and Contact Information

Vybe Cabs has appointed a Grievance Redressal Team, in accordance with the DPDP Act and Rule 5(9) of the SPDI Rules, to address questions, concerns, complaints or requests relating to this Policy or the processing of personal data. Grievances may be submitted using the following details:

Vybe Cabs will acknowledge and respond to grievances within the timeline prescribed under applicable law, and in any event within a reasonable period from the date of receipt. All grievance records, correspondence and investigations are handled in strict confidentiality and are not disclosed publicly unless required under applicable law. If a Data Principal is not satisfied with the response, they may escalate the grievance to the Board through the mechanism prescribed under the DPDP Act.

24Policy Validity and Interpretation

This Policy forms an integral part of Vybe Cabs’ overall compliance, ethics and governance framework. If any provision of this Policy is deemed invalid or unenforceable by a competent authority, such invalidity shall not affect the enforceability of the remaining provisions. Section titles and clause headings are included for convenience only and shall not influence interpretation or intent. In the event of discrepancies between translations, the English version of this Policy shall prevail as the authoritative version. This Policy remains in effect until superseded by a revised and duly published version.

25Acknowledgement

By accessing or using the Vybe Platform or Vybe Cabs’ B2B services, the relevant User, corporate customer, authorised representative or visitor acknowledges that they have read and understood this Policy and consent to the data practices described herein. Where a corporate customer provides personal data to Vybe Cabs on behalf of its employees, representatives or passengers, the corporate customer confirms that it has complied with its applicable obligations relating to such personal data, including providing appropriate notice and obtaining consent as required under the DPDP Act.