12GO PRIVACY POLICY

We, 12Go Asia Pte. Ltd., company no. 201228224R (“12Go", "we", "us" or "our"), with registered place of business at 75 High Street Singapore 179435, and our corporate affiliates (including 12Go Europe Ltd., company no. HE 402152, with registered place of business at Tlais Tower, 1^st Floor, 1070 Nicosia, Cyprus), are committed to protecting and respecting your privacy. We believe in transparency and want you to feel comfortable using our platform, and we are committed to being upfront about how we treat your personal data.

Our Terms of Use require all account owners to be at least 20 years of age (or have the permission and supervision of a responsible parent or legal guardian), therefore, this Policy does not discuss use of our Services by minors.

1. Important information and who we are

a. Purpose of This Privacy Policy

This Privacy Policy ("Policy") applies to the Personal Data that 12Go obtains in various contexts, both online and offline, directly from you or from an authorized third party, including when you (“you” or “your”): access or use our website (the "Site"), our online platform that allows you to book or reserve travel related services from third party suppliers or via travel agent (online or offline on premises); access or use our mobile apps, or any other apps or services that link to this Privacy Policy; purchase or use our products, services or features or engage with us on social media; interact with our advertising or marketing materials; or participate in any of our programs or events. Our "Services" as the term is used in this Policy, including our Site, mobile apps, products, services, and features, as well as our online transportation booking platform. We have designed this Policy to make sure that you are aware of the options available to you when you access and use our Services.

Our privacy practices are subject to the applicable laws of the places in which we operate, so you may see additional region-specific terms that only apply to customers located in those geographic regions, or as required by applicable laws.

It is important that you read this privacy policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we are using your data. This Policy supplements the other notices and is not intended to override them.

b. Data Controller

12Go is the controller responsible for your Personal Data.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Policy. If you have any questions about this Policy, including any other inquiry regarding your privacy rights, please contact the DPO using the details set out below.

c. Contact Details

Our full details are:

• 12Go Asia Pte. Ltd.

• Email address: dpo@12Go.asia

• Postal address: 75 High Street Singapore

You have the right to make a complaint at any time to the relevant supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach such authority, so please contact us in the first instance.

d. Your Duty to Inform us of Changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

e. Third-Party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies and practices. When you leave our website, we encourage you to read the privacy policy of every website you visit.

2. The Personal Data we collect and process:

We collect two basic types of information from you when you provide it or when you use or interact with our Services or through our advertising and media across the Internet: Personal Data and Non-Personal Data.

“Personal Data”, or personal information, means any information that relates to you, from which you can be directly or indirectly identified or which makes you identifiable. It does not include anonymised data.

We do not collect any special categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). We also do not collect any information about criminal convictions and offences.

“Non-Personal Data” means any data that does not identify you or data that have been anonymized. When we combine non-personal data with personal data, we treat the combined data as Personal Data.

We may collect, generate, use, store and transfer different kinds of Personal Data about you:

a. Information you provide us

In the table below, we have set out the contexts in which we will process Personal Data including the categories of Personal Data, the purposes and legal bases for processing.

As a Supplier, your brand name may be publicly displayed and connected to your activity on or in connection with our Services. Other people may see your activity statistics, reviews, ratings, and profile information. Such information is collected and processed by us only if you expressly consent thereto.

For online payments and other transactions, we use various third-party payment service providers (the “PSP”). To enable PSP to provide this online payment service, we collect and store certain identification data from users of the Services. This identification data may include such Personal Data as your name, email, credit card number, card expiration date, billing address, and CVV code. We only use any such Personal Data collected in order to enable the PSP online payment service, and always ensure sufficient security of such personal data. Please refer to the privacy notice of the relevant PCP for information on how they process Personal Data.

If you actively consent to receiving newsletters, marketing and promotional information from us, we will also process your email address for the purpose of providing you with the same. You may withdraw your consent at any time through the “unsubscribe” link at the bottom of each of our marketing emails.

We may also use tracking pixels in our email newsletter enabling us to see if and when an email was opened and if certain links in that email were clicked by the addressee. This allows analysis, reporting and optimization of email marketing campaigns. Legal basis of the usage of such tracking pixels is your consent. You may withdraw your consent at any time through the “unsubscribe” link at the bottom of each of our marketing emails.

Any information you provide us is provided by you voluntarily, and you may withdraw your consent to the use of your Personal Data hereunder at any time. However, certain information is required in order for you to register and enjoy the full benefits of our Services, and a withdrawal of your consent might limit your ability to enjoy our Services.

We may also combine your Personal Data collected through various sources, including data you provide and data collected through our Services, and develop a customer profile that will be used for the purposes above.

b. Information we collect from your use of the Services

When you interact with our Services, we may automatically collect (by cookies, web beacons and similar technologies) certain information: (a) technical information, including the Internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time zone setting, language preferences, browser plug-in types and versions, operating system, version, device information and the geographic location of the device that you are using to log-in. If you choose to save your password for automatic sign-in, we will also record your password in a cookie file; (b) information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for, the frequency and scope of your use of the Services, page interaction information (such as scrolling, clicks, and mouse-overs), the content you viewed (including advertisements you clicked on) and pages you visited, your communications with other users and third parties, and cookie data. You can grant or revoke your consent to our collection of your location at any time and/or prevent us from continuing to access your GPS information by disabling the GPS or other location-tracking functions on your device, provided your device allows you to do this. You can set your cookie preferences by using the cookie banner that appears when you visit the homepage of our Sites.

To learn more about cookies, how to control their use or delete them, and how this may affect our Services, please read our Cookie Policy.

c. Collaboration with Google and other Third-Party Ad Networks.

We collaborate with Google and other third party vendors or advertising networks as business partners. Google uses cookies to help serve the ads it displays on the websites of its partners, such as websites displaying Google ads or participating in Google certified ad networks. When users visit a Google partner’s website, a cookie may be dropped on that end user’s browser.

• Third-party vendors and ad networks may serve ads on our site
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on you visit to our sites and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google's Ads Settings. Alternatively, you can opt out of some third-party vendor’s use of cookies for interest-based advertising by visiting info.
• The links to the vendor and ad network websites are as follows:
• You may visit the foregoing websites to opt out of the use of cookies for interest-based advertising (if the vendor or ad network offers this capability). Alternatively, you can opt out of some third-party vendor’s use of cookies for interest-based advertising by visiting .

We also collect, use, and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your Personal Data but is not considered Personal Data as this data does not directly or indirectly identity you. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Policy.

d. Collaboration with Social Media providers

We use social media in different ways including to facilitate the booking of transportation services and to promote and advertise our Services.

You may use one of the integrated social media plug-ins on our Site and mobile apps to link to your social media account. If you choose to receive a pdf. confirmation of your booking on Facebook Messenger, we will use your Facebook user ID to facilitate this. Links to social media platforms are placed on some emails you receive from us. This is intended to encourage you to follow us on social media.

If you click on one of the social media links on our Site, mobile app or email, the social media provider may collect certain information about you. Please refer to the relevant social media platforms for information about how they process Personal Data.

If you’re logged into your social media account when you click or tap one of those links, your social media provider may relate this information to your social media account and use this to create a profile about you for advertising purposes. Depending on your settings, they might also display these actions on your social media profile, to be seen by others in your network.

We use the following social media platforms. Please refer to the relevant social media provider's privacy notice for more information about how they process your Personal Data.

• Facebook
• Instagram
• X (formerly Twitter)
• Pinterest
• TikTok

e. If you fail to provide Personal Data

Where we need to collect Personal Data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or Services). In this case, we may have to cancel a product or Service you have with us, but we will notify you if this is the case at the time.

12Go limits access to your Personal Data by 12Go personnel to those whom we believe reasonably need that information to provide products or services to you or in order to do their jobs.

f. Change of Purpose for processing

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the additional purpose and the legal basis which allows us to do so.

3. Disclosure of your information to third parties

We do not sell Personal Data and we do not share Personal Data with third parties for cross-context behavioral advertising purposes.

We value your privacy and will not share your Personal Data except with the parties set out below for the purposes indicated in Section 2 above:

• Our Services connect Travelers and Suppliers. If a Traveler purchases Transportation Services through our Services, we provide the relevant information of the Supplier (name, location, contact details) to the Traveler and vice versa.
• Service providers acting as processors including but not limited to those based in the US and in Singapore who provide IT and system administration services.
• Professional and legal advisers, regulators and other authorities, including lawyers, bankers, auditors and insurers, who provide consultancy, banking, legal, insurance and accounting services and/or who require reporting of processing activities in certain circumstances.
• We may disclose Personal Data (i) as a response to a legal request (such as a court order, search warrant, or subpoena) if we believe that we are required to do so by applicable law; or (ii) when we believe that such disclosure or use is necessary in order to: reveal, prevent and address fraud, intellectual property infringement, piracy, or other illegal activities; enforce this Policy or our Terms of Use ,including in order to investigate potential breaches; protect our rights, property or safety, or those of our users or from members of the public from harm, as required or permitted by law; and prevent death or imminent bodily harm. In such events, 12Go may disclose a name, address, country, phone number, email address and company name.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same or similar ways as set out in this Policy.

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

We may also share aggregated or non-Personal Data that we collect under any of the above circumstances with our business partners, affiliates or other third parties to develop and deliver targeted advertising on our Sites and on websites of third parties. We also may share aggregated information with third parties, including advisors, advertisers and investors, for the purpose of conducting general business analysis. For example, we may tell our advertisers the number of visitors to our Sites and the most popular features or services accessed. This information does not contain any Personal Data and may be used to develop website content and services that we hope you and other users will find interesting and to customise content and advertising.

4. Transfers of Personal Data

We are a Singaporean company, and part of a group of companies headquartered in Tel Aviv, Israel. Please be aware that we may need to transfer your Personal Data, to Israel, the United States, Singapore, Argentina, Brazil and other countries through certain third parties that we use to operate and manage the Site and Services, including Google Cloud Storage.

Further, in order for us to provide you with the Transportation Services that you have booked, we have to share your name, contact information and certain other Personal Data as necessary for the booking of the specific Transportation Services with the relevant Supplier located in the country where the Transportation Services are provided. In certain circumstances, these countries may not provide the same standard of protection for Personal Data as the country in which you are located. We require our Suppliers to store Personal Data securely and to implement appropriate technical and organisational measures for the security of Personal Data.

If you are located in a country or territory that restricts the transfer of Personal Data, booking transportation services to certain destinations may require the transfer your Personal Data to a country that does not maintain the same data protection standards as the country in which you reside.

If you are located in the EEA or the UK, we transfer your personal data outside the EEA or UK based on one of the following conditions:

• the transfer is to a country that has been deemed to provide an adequate level of protection for Personal Data under data protection law of the EEA or the UK (as applicable).;
• the transfer is subject to appropriate safeguards such as approved standard contractual clauses under applicable data protection law of the EEA or the UK (as applicable); or
• the transfer is subject to an exemption under applicable data protection law of the EEA or the UK (as applicable).
• Where we use providers based in the US, such as Google Cloud Storage, we may transfer Personal Data to them if they are part of the EU-US Data Privacy Framework and the UK-US Data Bridge which requires them to provide similar protection to Personal Data as that provided under data protection law of the EEA or the UK (as applicable). Otherwise we ensure we have in place appropriate safeguards such as executing the relevant standard contractual clauses with such providers, unless an exception applies to such transfer.

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of the EEA or the UK.

5. Data Retention

12Go will retain your information only for as long as is necessary for the purposes set out in this Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, or for as long as your account is active, or as needed to provide you services, or for the relevant term under the respective statute of limitation that may apply to the relationship between you and us.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

If you no longer want 12Go to use your information to provide you Services, you may close your account. 12Go will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We will delete your information after the applicable limitation period has lapsed.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

6. How do We Secure Your Information?

We consider data security a top priority and we do our best to keep your Personal Data secure. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Such measures include:

• Encrypting many of our Services using SSL.
• Employing firewalls and intrusion detection systems.
• Practicing administrative, technical, and physical security procedures to help protect the information you provide us.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with personal data breaches (whether such breach is actual or a probable threat) and will notify you and any applicable regulator of a breach where we are legally required to do so.

Please keep in mind that no method of transmission over the Internet, or method of electronic storage, is 100% secure. As a result, although we strive to protect your personal information, we cannot promise or guarantee that such information will be immune from any wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem by contacting us in accordance with the “Contact Us” section above.

7. Protection of Children’s Privacy

Our Services are not for children or those under the age of twenty (20). We do not knowingly collect Personal Data from children or other persons who are under 20 years of age. Individuals who are children or those under the age of 18 should not attempt to provide us with any Personal Data.

If it comes to our attention through reliable means that a registered user is a child or under twenty (20) years of age, we will cancel that user’s account and/or access to the Services. If you think we have received Personal Data from children or those under the age of 20, please contact us immediately in accordance with the “Contact Us” section above.

8. Your Legal Rights

If, and to the extent that, you are entitled under applicable data protection law of the country, province, or territory where you are located, you may exercise certain choices and rights in connection with your Personal Data as described in this section. Please note that some of the following rights may not, therefore, apply to you or may vary depending on where you are located.

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it subject to exemptions as set out in applicable law.
• Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with applicable local law. Note, however, that we may not always be obliged to comply with your request of erasure for specific legal reasons which, if applicable, will be notified to you at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• You also have the right to not receive discriminatory treatment for exercising the above rights.
• Complain to the relevant supervisory authority where you are unhappy about our processing of your Personal Data.

If you wish to exercise any of the rights set out above, or to delete your account, please contact us under dpo@12go.asia .

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is manifestly unfounded, or excessive (for example, because of their repetitive character). Alternatively, we may refuse to comply with your request in these circumstances, but we will let you know if that is the case and our reasons for refusal.

Submitting a Privacy Request

You can submit a privacy right request by:

• Submitting a Request Form
• Calling +66-945-675-516
• Emailing .

Verification Process and Required Data

We may need to verify your identity before responding to your privacy right requests in order to confirm the request came from you. We may contact you by phone or e-mail to verify your request. This process may require us to request additional Personal Data from you, including, but not limited to, your email address, mailing address, account name, and/or date of last interaction with us and / or a recent utility invoice and/or approved photo ID. We may decline a request to exercise a privacy right, where we are unable to verify your identity.

Responding to Requests

Once you have submitted your request, we will respond within the time frame permitted by the applicable law.

Appealing Requests

You may appeal our decision to your request regarding your personal data. To do so, please contact us in any of the ways listed above. We respond to all appeal requests as soon as we reasonably can, and no later than legally required.

Authorized Agent

You may designate an authorized agent to submit a request on your behalf. To do so, you must (1) verify your own identity directly with us; and (2) provide the authorized agent with written documentation of their authority to act on your behalf, such as: (a) a power of attorney; or (b) sufficient evidence to show that you have provided the authorized agent signed permission to act on your behalf and directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

9. Your California Privacy Rights

We do not share personal data with third parties for their own direct marketing purposes without your consent. California residents under 18 years old, in certain circumstances, may request and obtain removal of personal data or content that you have posted on our Services. Please be mindful that this would not ensure complete removal of the content posted by you on our Services. To make any request pursuant to California privacy law, please contact us in accordance with the “Contact Us” section above.

10. Changes to Our Privacy Policy

We reserve the right to change our Privacy Policy from time to time by posting the changes, where appropriate, notifying you by e-mail. If we choose to amend this Policy, we will revise the last updated date at the top of this Policy when we post the updated version. Please check back frequently to see any updates or changes to our privacy policy.

Your continued use of our Services following the posting of changes to this Policy or providing notice to you, whichever occurs first, means that you accept those changes.

11. General

If any provision of this Policy is deemed invalid by a court of competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Policy, which shall remain in full force and effect, provided, however, that in such event this Policy shall be interpreted so as to give effect, to the greatest extent consistent with, and permitted by, applicable law, to the meaning and intention of the excluded provision as determined by such court of competent jurisdiction.

12. Our UK Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

United Kingdom (UK)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following websites:

Prighter | Compliance Landing Page of 12Go Asia Pte Ltd

Prighter | Compliance Landing Page of 12Go (Thailand) Co. Ltd.

Appendix: California Privacy Law

This appendix seeks to provide additional information to residents of California and supplements the information provided in the Privacy Policy. As discussed above in further detail, we do not “sell” and/or “share” any “personal information” as such terms are defined under California privacy law.

To learn more about the categories of personal information we collect, how we collect it, why it is collected, with whom we share it, and how long we retain it, please see the chart below. Please see the instructions provided above the Your Legal Rights section in order to submit a privacy right request.

Effective 4 April 2025