Effective Date: 11.05.2025 This Privacy Policy explains how Shunkhlai LLC (“we”, “our”, or “us”) collects, uses, discloses, and safeguards information when businesses, authorized drivers, and related users access or use the Orange Driver B2B mobile application (the “App”) and the associated web portal at b2b.shunkhlai.mn (together, the “Platform”). We are committed to protecting your organisation’s and individuals’ data in line with applicable law, mobile‑app store privacy requirements, and industry best practices. 1. Information We Collect When your organisation and affiliated users utilise the Platform, we may collect the following categories of information: Business Account Information: Company name, registration number, billing address, contact person name, business email, business phone number. Driver & Vehicle Information: Driver name, driver phone, vehicle registration or licence plate number, assigned fuel card or RFID/membership tag ID. Transaction Data: Records of fuel or service purchases including date/time, station location, fuel type/quantity, price, payment method, total amount, account/vehicle association. Device & Usage Data: Device IP address, device model, operating system version, time zone, browser type, app version, interaction logs, session duration. Location Data: With valid permission, device or vehicle location data may be collected for fleet monitoring, routing support or station recommendation. Communications & Support Data: Emails, chat records, support ticket details, feedback, customer service interactions. Other Data: As required for compliance, audits, legal obligations or fraud prevention (e.g., company registration verification, driver identity verification). 2. How We Use the Information We use the information we collect for purposes including, but not limited to: Establishing and managing corporate accounts and authorised driver access. Enabling transaction processing, invoice generation, reporting and account summaries. Sending notifications, system alerts, updates, customer support communications, and service‑related messages. Offering tailored discounts, rewards or loyalty benefits to organisations and authorised users. Complying with tax, financial, accounting, audit and regulatory obligations under Mongolian law or other jurisdictions as required. Enhancing the security, reliability, functionality and user‑experience of the Platform. Detecting, preventing or responding to fraud, misuse, or unlawful activities. Facilitating business transfers, acquisitions or organisational restructuring where applicable. 3. Information Sharing & Disclosure We will share or disclose information only under the following circumstances: Service Providers & Vendors: Entities that perform services on our behalf (hosting, analytics, payment processing, IT support, logistics) under contract and confidentiality obligations. Legal, Regulatory or Government Requirements: Where disclosure is necessary to comply with laws, lawful requests, audits or litigation. Business Transfers: In connection with a merger, acquisition, asset sale or corporate restructuring, we may transfer your organisation or user data to the successor or acquiring entity. With Your Consent: When you authorise or request sharing of your data with a specific third party (integration partner, external reporting service, etc.). We do not sell, lease or rent your business, driver or transaction data to third parties. 4. Data Security We implement appropriate administrative, technical and physical safeguards to protect information from unauthorised access, disclosure, alteration or destruction. These measures are based on current industry standards and are tailored to the nature of the data we handle. That said, no electronic system is entirely immune to risk. We recommend that your organisation maintain strong internal controls (passwords, access restrictions, employee training) to complement our protective efforts. 5. Data Retention & Deletion We retain personal, business and transaction data only as long as necessary to fulfil the purposes outlined in this policy, to meet our contractual obligations, and to comply with relevant legal, regulatory or tax retention requirements. You may request the deletion or anonymisation of your organisation’s or authorised user’s data by contacting our support team. We will review and respond to such requests, subject to legal or regulatory constraints. Upon account closure or end of service, data will be archived or deleted according to our retention policy and applicable law. 6. Your Rights & Choices As a business user or authorised driver, you have the following rights and choices: Access & Correction: You may review, update or request correction of your organisation’s or driver’s data within the Platform or via our support contact. Location Data Control: You may enable or disable location services for the Platform via your device settings; disabling may limit certain features. Account Closure & Data Deletion Request: Your organisation may request account termination and data deletion in accordance with the terms of service and applicable law. Data Portability or Export (if applicable): You may request export of your organisation’s or authorised user’s data in a commonly‑used machine‑readable format, where feasible and as permitted by law. 7. Children’s Privacy The Platform is intended exclusively for corporate customers and authorised drivers who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18 in connection with our B2B services. If we become aware of such collection, we will take steps to delete the information. 8. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our business practices, services, legal requirements, or other regulatory developments. We will post the revised version on the Platform (App and website) and update the “Effective Date” accordingly. In the event of a material change, we will provide notice through the Platform or by email to your designated contact. 9. Contact Us If you have questions, concerns or requests regarding this Privacy Policy or how we handle your data, please contact us: Shunkhlai LLC Capital House, Chinggis Avenue 48/1 Ulaanbaatar 17040, Mongolia info@shunkhlai.mn | 976‑70073003 Effective Date: 11.05.2025 This Privacy Policy explains how Shunkhlai LLC (“we”, “our”, or “us”) collects, uses, discloses, and safeguards information when businesses, authorized drivers, and related users access or use the Orange Driver B2B mobile application (the “App”) and the associated web portal at b2b.shunkhlai.mn (together, the “Platform”). We are committed to protecting your organisation’s and individuals’ data in line with applicable law, mobile‑app store privacy requirements, and industry best practices. 1. Information We Collect When your organisation and affiliated users utilise the Platform, we may collect the following categories of information: Business Account Information: Company name, registration number, billing address, contact person name, business email, business phone number. Driver & Vehicle Information: Driver name, driver phone, vehicle registration or licence plate number, assigned fuel card or RFID/membership tag ID. Transaction Data: Records of fuel or service purchases including date/time, station location, fuel type/quantity, price, payment method, total amount, account/vehicle association. Device & Usage Data: Device IP address, device model, operating system version, time zone, browser type, app version, interaction logs, session duration. Location Data: With valid permission, device or vehicle location data may be collected for fleet monitoring, routing support or station recommendation. Communications & Support Data: Emails, chat records, support ticket details, feedback, customer service interactions. Other Data: As required for compliance, audits, legal obligations or fraud prevention (e.g., company registration verification, driver identity verification). 2. How We Use the Information We use the information we collect for purposes including, but not limited to: Establishing and managing corporate accounts and authorised driver access. Enabling transaction processing, invoice generation, reporting and account summaries. Sending notifications, system alerts, updates, customer support communications, and service‑related messages. Offering tailored discounts, rewards or loyalty benefits to organisations and authorised users. Complying with tax, financial, accounting, audit and regulatory obligations under Mongolian law or other jurisdictions as required. Enhancing the security, reliability, functionality and user‑experience of the Platform. Detecting, preventing or responding to fraud, misuse, or unlawful activities. Facilitating business transfers, acquisitions or organisational restructuring where applicable. 3. Information Sharing & Disclosure We will share or disclose information only under the following circumstances: Service Providers & Vendors: Entities that perform services on our behalf (hosting, analytics, payment processing, IT support, logistics) under contract and confidentiality obligations. Legal, Regulatory or Government Requirements: Where disclosure is necessary to comply with laws, lawful requests, audits or litigation. Business Transfers: In connection with a merger, acquisition, asset sale or corporate restructuring, we may transfer your organisation or user data to the successor or acquiring entity. With Your Consent: When you authorise or request sharing of your data with a specific third party (integration partner, external reporting service, etc.). We do not sell, lease or rent your business, driver or transaction data to third parties. 4. Data Security We implement appropriate administrative, technical and physical safeguards to protect information from unauthorised access, disclosure, alteration or destruction. These measures are based on current industry standards and are tailored to the nature of the data we handle. That said, no electronic system is entirely immune to risk. We recommend that your organisation maintain strong internal controls (passwords, access restrictions, employee training) to complement our protective efforts. 5. Data Retention & Deletion We retain personal, business and transaction data only as long as necessary to fulfil the purposes outlined in this policy, to meet our contractual obligations, and to comply with relevant legal, regulatory or tax retention requirements. You may request the deletion or anonymisation of your organisation’s or authorised user’s data by contacting our support team. We will review and respond to such requests, subject to legal or regulatory constraints. Upon account closure or end of service, data will be archived or deleted according to our retention policy and applicable law. 6. Your Rights & Choices As a business user or authorised driver, you have the following rights and choices: Access & Correction: You may review, update or request correction of your organisation’s or driver’s data within the Platform or via our support contact. Location Data Control: You may enable or disable location services for the Platform via your device settings; disabling may limit certain features. Account Closure & Data Deletion Request: Your organisation may request account termination and data deletion in accordance with the terms of service and applicable law. Data Portability or Export (if applicable): You may request export of your organisation’s or authorised user’s data in a commonly‑used machine‑readable format, where feasible and as permitted by law. 7. Children’s Privacy The Platform is intended exclusively for corporate customers and authorised drivers who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18 in connection with our B2B services. If we become aware of such collection, we will take steps to delete the information. 8. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our business practices, services, legal requirements, or other regulatory developments. We will post the revised version on the Platform (App and website) and update the “Effective Date” accordingly. In the event of a material change, we will provide notice through the Platform or by email to your designated contact. 9. Contact Us If you have questions, concerns or requests regarding this Privacy Policy or how we handle your data, please contact us: Shunkhlai LLC Capital House, Chinggis Avenue 48/1 Ulaanbaatar 17040, Mongolia info@shunkhlai.mn | 976‑70073003
