Regional Privacy Addendum

This addendum supplements the Privacy Policy for users in regions with specific privacy laws. It should be reviewed before launch in each target market.

1. EEA / EU users

For users in the European Economic Area, the GDPR may apply.

Potential legal bases:

• Contract: account creation, parking records, vehicles, subscriptions, and core

app functionality.

• Consent: optional permissions or optional processing where required.
• Legitimate interests: security, fraud prevention, debugging, and service

reliability, balanced against user rights.

• Legal obligation: tax, accounting, and compliance records.

Users may have rights to access, rectify, erase, restrict processing, object, data portability, withdraw consent, and lodge a complaint with a supervisory authority.

If the controller is outside the EEA and targets EEA users, an EU representative or other required arrangements may be needed unless an exception applies.

2. UK users

For users in the United Kingdom, the UK GDPR and Data Protection Act may apply.

Users may have rights similar to EEA users, including the right to be informed, access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making where applicable.

If the controller is outside the UK and targets UK users, a UK representative or other required arrangements may be needed unless an exception applies.

3. California users

For California residents, the CCPA/CPRA may apply if the business meets the law's applicability thresholds.

Categories of personal information that may be collected include:

• Identifiers, such as email address and user ID.
• Internet or electronic network activity information, such as technical logs.
• Geolocation data, including precise parking and navigation coordinates.
• Commercial information, such as subscription status and purchase history.
• User-provided content, such as photos and support messages.
• Inferences are not intentionally created for advertising in the current

product design.

Where the CCPA applies, users may have rights to know, delete, correct, opt out of sale/share, limit use of sensitive personal information, and not be discriminated against for exercising rights.

Where's My Car does not intend to sell personal information or share it for cross-context behavioral advertising. If advertising, attribution, or analytics tools are added, this statement must be reassessed.

4. Turkey users

For users in Turkey, KVKK may apply. Turkey-specific notices should be provided in Turkish:

• kvkk_aydinlatma_metni.txt
• acik_riza_metni.txt

Location, cross-border transfer, explicit consent, data controller identity, retention/destruction policy, and data-subject request channels should be reviewed under Turkish law before launch.

5. Other regions

If Where's My Car targets users in Brazil, Canada, South Korea, Japan, Australia, or other regulated markets, additional localized notices or addenda may be required.

6. Contact

Privacy requests: privacy@wheresmycar.io

Data deletion: delete@wheresmycar.io