Asia

The below “Country Addenda” supplement and form part of the Privacy Notice.

For consistency, capitalized terms have the meanings assigned to them here unless otherwise noted.

Please note that this page may be updated as necessary to address evolving operations and regulations.

China

Overview

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of the People’s Republic of China and describes how we collect, use, disclose, and store your Personal Information in accordance with the Personal Information Protection Law (“PIPL”).

We will abide by the following principles with respect to your Personal Information: legality, legitimacy, necessity, good faith, transparency, responsibility, and reasonableness.

Personal information and sensitive personal information

Personal Information refers to various information related to identified or identifiable natural persons recorded electronically or otherwise, excluding anonymized information. Sensitive Personal Information refers to Personal Information that, once leaked or illegally used, may easily lead to the infringement of the personal dignity of natural persons or the harm of personal and property safety, including biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts and Personal Information of minors under the age of fourteen.

Legal Bases: Please see the following for more details related to how and why we process your information:

• Personal Identifiers: Name, alias, postal address, online identifier, IP address, email address, account name, driver’s license.
• Sensitive Information: Age, race, color, ancestry, national origin, creed, religion, marital status, gender identity, medical conditions and veteran or military status.
• Financial information: Records related to how you use Services and transactions made with your Carrot Card®.

Data retention

The Personal Information we generate, collect and obtain during our operations within the territory of the People’s Republic of China will be stored overseas. Unless otherwise stipulated by applicable law, we will only store your Personal Information for the shortest time necessary to achieve the purpose of processing.

Cross-border transfer of personal information and protection

We transfer Personal Information overseas in accordance with the requirements set forth in applicable law and as needed to fulfill our legal obligations with your Employer. We use commercially reasonable measures to protect the confidentiality and safety of your information.

Your rights

In addition to the rights outlined here, you have the following data subject rights:

• You have the right to review and copy your Personal Information, unless otherwise stipulated by laws and administrative regulations;
• You have the right to correct inaccuracies associated with your Personal Information;
• You have the right to change the scope of your consent and/or withdraw consent;
• You have the right to portability with respect to your Personal Information;
• You have the right to request an interpretation of this Privacy Notice from us;
• You have the right to object to the use of automated decision-making;
• You have the right to ask us to delete your Personal Information under specific circumstances.

We do not charge a separate fee for you to exercise your rights. However, for repeated requests that exceed reasonable limits, we reserve the right to charge a separate fee. We have the right to refuse requests that are unreasonably repetitive, require excessive technical means, pose risks to the legitimate rights and interests of others, or are impractical.

Please contact us at the following email if you have questions or would like to exercise your rights: data-requests@get-carrot.com.

PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Updates to this addendum and how to contact us

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

The Philippines

Overview

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of the Philippines and describes how we collect, use, disclose, and store your Personal Information in accordance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”).

Collection, use, and disclosure of personal information

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

Data storage and international data transfers

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the DPA considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of the Philippines.

For more information on how we store, protect, and retain your information, please see here.

Your rights with respect to your information

In addition to the rights outlined here, you have the following data subject rights:

• Access to Personal Information we process about you.
• Rectification of your Personal Information.
• Erasure or order blocking of your Personal Information whenever warranted.
• The Right to Object if the Personal Information processing involved is based on consent or on legitimate interest.
• The right to Data Portability.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Updates to this addendum and how to contact us

Thailand

Overview

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Thailand and describes how we collect, use, disclose, and store your Personal Information in accordance with the Personal Data Protection Act 2019 (PDPA).

Data storage and protection

In order to provide services, Carrot will store and process your Personal Information in the United States. For more information on how we store, protect, and retain your data, please see here.

International data transfers

Carrot operates globally and your Personal Information will be transferred to countries outside of Thailand that are subject to different standards of data protection. We will take reasonable and appropriate steps to ensure that transfers of your data comply with applicable law and are managed to protect your privacy rights and interests.

Your rights with respect to your information

In addition to the rights outlined here, you have the following data subject rights:

• Access. You may request a copy of your Personal Information.
• Withdraw Consent. You have the right to withdraw consent to processing your information where we seek your consent.
• Rectification. You may request that we correct incomplete, inaccurate, misleading, or not up-to-date Personal Information.
• Erasure. You have a right to request that we delete or anonymize your Personal Information.
• Opt Out/Object. You may object to the collection, use, or disclosure of your Personal Information in certain circumstances.
• Portability. You may request a copy of the Personal Information we retain about you in a readable format.

Complaints

You may file a complaint with the Personal Data Protection Committee.

Updates to this addendum and how to contact us

India

Overview

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of India and describes how we collect, use, disclose, and store your Personal Information in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA).

Collection, use, and disclosure of personal information

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

Data storage and international data transfers

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the DPDPA considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of India.

For more information on how we store, protect, and retain your information, please see here.

Your rights with respect to your information

In addition to the rights outlined here, you have the following data subject rights:

• The right to Access your Personal Information that is being processed;
• The right to Correct incomplete, inaccurate data;
• The right to request that we Erase your Personal Information.

Updates to this addendum and how to contact us