Privacy Policy

Last Updated: [●] 2026

Castrol Gogoro Mobility Joint Stock Company (hereinafter collectively referred to as “we” or “CGM”) is a high-tech company providing our customers with advanced, energy saving, environmentally friendly and sustainable transportation vehicles and services. We respect and are committed to protecting your privacy and personal data. In this Privacy Policy (the “Policy”), we explain how we, as a data controller, handle your personal data when you use CGM’s products and/or services and/or access our mobile application (“app”) and/or our website in order to use CGM’s services. Please read this Policy carefully before you use CGM’s products and/or services including but not limited to the CGM Smartscooter, CGM’s website/app and CGM’s servicing workshops (collectively, “CGM Products and/or Services”). If you accept the provisions of this Policy, you are agreeing to us collecting and processing your personal data in the ways that are set out in this Policy.

CGM Products and/or Services, and this Policy, apply only to persons aged 16 years or older, and by using CGM Products and/or Services and/or accepting this Policy, you represent that you are aged 16 years or older.

1. WHAT PERSONAL DATA WE COLLECT AND PROCESS

Personal data means any data which can directly or indirectly identify your personal identity, such as your name and email address. Please note that we may collect your personal data for particular purposes based on the CGM Products and/or Services you use based on your prior consent.

When you create CGM account (the “CGM Account”), purchase and/or use any the CGM Products and/or Services, accept any software update, contact us, participate in our events or campaigns, or otherwise in any manners interact with CGM, we may collect a variety of your personal and other data depending on the CGM Products and/or Services you use within the necessary scope of purposes, including:

  • When you register for the CGM Account: We may collect your true, accurate, current and complete registration data, including your identification and description data such as your name, password, gender, picture, and the contact data such as your email address and mobile phone number.

  • When you purchase or subscribe to CGM Products and/or Services such as CGM Smartscooter, CGM app services, CGM’s website and CGM’s servicing workshops: We may collect the identification and description data such as your name, CGM Account ID, age, date of birth; under certain limited circumstances, we may ask for your government-issued ID such as your national identification ID number, passport, residency proof, work permission, work certificate, driver license, and other related details; if any payment or third party financial services are involved, we may collect your financial and payment data such as your credit card number or other payment card information, bank account passbook cover, accidents or other mishaps information, and relevant situation data; if you are subscribing or have ever subscribed to the CGM app services, we may collect the tariff plan(s) you are subscribing or have ever subscribed, billing, payment method(s) and status.

  • When you use the CGM Products and/or Services which are associated to the CGM Account such as the CGM Smartscooter, CGM app services, CGM’s website and CGM’s servicing workshops: We may collect your information with respect to the use of the CGM Products and/or Service such as the CGM Smartscooter VIN, plate number, model and other hardware and firmware information, real-time status, owner’s name, batteries’ serial numbers, and the settings of your CGM Smartscooter(s); we may also collect the CGM app service tariff plan(s) you are subscribing and have ever subscribed, battery swapping service usage records, the battery swapping station location(s) where you have ever used to swap batteries; we may also collect your real-time location, and CGM Smartscooter(s) riding and relevant behavioral information, your CGM Smartscooter repair, maintenance and warranty services usage records.

  • When you make an appointment and participate in the CGM Smartscooter(s) test ride program: We may ask for and collect your government-issued driver license information; we may also collect your identification and description data such as your name, age and date of birth, and the contact data such as your residence address, email address, mobile phone number etc.

  • When you enter or approach CGM business premises: We may collect your personal photos, photocopy and videos taken by the surveillance cameras of battery swapping station(s) or in our other business premises.

  • When you participate in CGM events or campaigns: We may collect the identification and description data such as your name, gender, age and date of birth; the contact data such as your email address and mobile phone number; and other relevant data such as your hobbies, consumption behavioral patterns and driver’s licence details.

  • When you use Digital Scooter Key Service: We may receive from other digital service platform providers (such as Apple, Google etc.) your account ID and phone identifier with such providers. If you share your Digital Scooter Key with any other person through our Digital Scooter Key Service, we may receive from such providers the account ID and phone identifier of such person who received the Digital Scooter Key from you.

  • When you use CGM customer services: We may collect your identification information such as name, gender, age, date of birth; under certain circumstances; we may ask for your government-issued ID such as your national identification ID number, passport, residency proof and driver license; we may collect, depending on your inquiry, your CGM Smartscooter(s) condition information, the relevant contract(s) information between you and us, the CGM app service tariff plan(s) you are subscribing and have ever subscribed, your payment records, methods and status; we may collect the communication records between our customer service specialist and you; if you use our voice/phone customer services, we may record and keep the conversation between our customer service specialist and you.

Please note that we may only collect the relevant personal data for particular purposes based on the CGM Products and/or Services you use, rather than collect each and every personal data of the above categories. Further, you are not obliged to provide your personal data according to our request; however, if you choose not to provide your personal data as requested by us, we may not be able to provide you with the relevant CGM Products and/or Services. Please refer to Section 8 for further details.

Sensitive personal data

Under Vietnamese law, certain types of personal data within the above categories are classified as sensitive personal data, including:

  • Payment and financial data, such as payment card details, bank account information, and transaction records;

  • Payment records, methods and status for service tariff plan(s);

  • Government-issued identification, such as national ID cards, passports, residence documents, work permits, and driver's licences;

  • Location data, including real-time and historical location of you or your CGM Smartscooter (e.g. battery swapping station usage or navigation data);

  • Usage and behaviour data, such as riding and usage logs that reflect activity patterns over time.

  • Hobbies and, consumption behavioral patterns.

We apply enhanced security and confidentiality measures when processing sensitive personal data, including strict access controls, encryption, and internal policies. Access to such data is limited to authorized personnel and service providers on a need-to-know basis for the purposes described in this Privacy Policy.

2. WHY AND HOW WE PROCESS YOUR PERSONAL DATA

There are a number of different legal bases for processing personal data. In a specific case, this will depend on how we process or will process your personal data and for what purpose. In the majority of cases, the legal bases include:

  • Where you have provided your consent to us processing your personal data in the manner as specified by us;

  • Where it is necessary to process your personal data for entering into an agreement or performing an agreement with you;

  • Where it is necessary to process your personal data for complying with relevant legal or regulatory obligations.

We, by ourselves or in collaboration with our designated local business partners, may collect and use your personal data for the following purposes in accordance with the following lawful bases:

Data processing purposes based on the lawful basis of entering into and performing our product and service agreement with you:

  • To provide the CGM Products and/or Services or third party's services that are associated to the CGM Account such as CGM Smartscooter, CGM app service plan(s): We may collect and process your personal data in order to provide you with the CGM Products and/or Services or with access to third party's services, including to inform you of updates to certain firmware and/or software. We collect and process your personal data based on the contractual or quasi-contractual relationship between you and us, or to perform our agreement with you as described in the Terms of Use, upon your registration of the CGM Account, or otherwise as notified by us to you from time to time, or for the purpose of providing credit card or debit card payment services for fees related to CGM Products and/or Services (including but not limited to identity verification services for credit card binding payments etc).

  • To provide test ride service of the CGM Smartscooter(s): We may collect and process your personal data in order to confirm whether you are qualified to ride an electric scooter under local traffic laws, keep your test ride records and relevant CGM product and/or service information.

  • To enable customization of your device: We may collect and process your personal data in order to enable customization of your device (including without limitation your CGM Smartscooter) based on your setting.

  • To perform diagnostics on your device: We may collect and process your personal data in order to perform diagnostics on your device (including without limitation your CGM Smartscooter, batteries) and to provide you with the status updates. This is necessary to ensure the proper functioning, safety, maintenance, and troubleshooting of our or third party’s products and services provided to you.

  • To manage your account(s) and perform our internal management work: We may process your personal data for our user account(s) management purposes, including to facilitate and improve our performance of the service(s) provided to you, to establish and maintain your account(s), as well as to ensure the security and proper functioning of your account(s), of the service(s). We may process your personal data in the course of the management of our business including in the event of a business sale or restructuring. These activities are conducted because they are necessary for our performance of our agreement with you (such as creating and managing your account(s)), for our legitimate interests (such as ensuring the security and proper functioning of your account(s), of the service(s), developing our business in the course of a business sale or restructuring), or for our compliance with applicable laws and regulations (such as fraud prevention).

  • To provide you with the product after-sales and other customer service: We may process customer feedback information including the problem type, description, images and error codes, for the troubleshooting purposes in accordance with our agreement with you, or, if we do not have any contractual relationship with you, based on our legitimate interest to troubleshoot any identified problem or provide consulting service; we may provide you with the above mentioned product after-sales and other customer service through online, voice or phone measures etc.

Data processing purposes based on your consent:

  • To send you event invitations and other marketing information in connection with the CGM Products and/or Services (if you are an existing client): Unless you object in accordance with Section 13 below, we will send you invitations to events that we host, co-host or sponsor, as well as other marketing information, such as recommendations of the products and/or services provided by CGM and/or third parties which are in collaboration with us, based on our legitimate interest to develop our business activity.

  • To send you event invitations and other marketing information (if you are a potential client): With your explicit consent, we may send you invitations to events that we host, co-host or sponsor, as well as other marketing information, such as recommendations of the CGM Products and/or Services and other services and/or products provided by third parties which are in collaboration with us.

  • To promote and improve the quality of CGM Products and/or Services and your client experience: We will collect and process your personal data, in particular to facilitate your browsing, based on our legitimate interest to improve the service, our website, our mobile application, and your client experience; further, in order to promote CGM Products and/or Services and enhance its quality continuously, we may collect and process your personal data for purposes such as investigation, statistics, analytics and marketing.

  • To customize your experience: With your explicit consent, we may collect and process your personal data in order to customize the content of the service and your browsing experience.

  • To host, co-host or sponsor events: If you choose to register for an event that we host, co-host or sponsor, we may use your personal data for the purpose of organizing and holding the event, based on our legitimate interest to develop our client relationship.

Data processing purposes based on our legal obligations and for the protection of our lawful rights and interests:

  • To fulfill legal and regulatory obligations: We collect and process your personal data in particular when we cooperate with public, governmental or regulatory authorities or to process your requests to exercise your rights, based on our legal obligations under applicable laws and regulations. We also process and retain your data to comply with applicable data storage and retention requirements (e.g., data localization under the Law on Cybersecurity, transactional data retention under the Accounting Law etc.).

  • To enforce our legitimate claims and other rights, and /or defend ourselves against legal claims: Where we are required to enforce our legitimate claims and other rights, participate in any litigation and/or arbitration which affects our business, we may process your personal data in compliance with applicable laws and regulations, in our legitimate interest, to the extent necessary for the establishment, exercise or defense of legal claims.

3. TO WHOM WE WILL SHARE YOUR PERSONAL DATA

To fulfill the data processing purposes and on the lawful bases described in Section 2 of this Policy, the personal data you provide to us may be shared with third party companies, including but not limited to our partners, agents, contractors, service providers, or business partners if this is necessary to provide you with our service(s), respond to your inquiries, or for any of the purposes described in this Policy. This may include:

  • Our vendors, suppliers, dealers, franchisees, partners or outsourced service providers;

  • Sub-processors who store or process the information on our behalf, in particular data analytics providers and data storage providers. Information shared with such providers is supplied in an anonymised format such that, that data cannot be linked to any particular individual and is therefore not considered to be “personal data”;

  • Our auditors, insurers, lawyers, and other professional advisers;

  • Law enforcement agencies, other governmental agencies, courts, or third parties if we are required by law to do so, or where we believe it necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party;

  • Our business partners, such as other electric scooter manufacturers;

  • Our collaborating entities, such as research institutions or corporate entities which conduct investigation, statistics and analytics-related projects.

  • Other business entities should we plan to merge with or be acquired by that business entity, or if we undergo a re-organisation with that entity.

We use outsourced service providers to assist us with the following:

  • Analytics: to monitor and analyze user traffic, to assess the popularity of specific functions and to keep track of your behavior when using the service, including for marketing and advertising purposes over time and across different services and devices;

  • Infrastructure monitoring: to monitor the use and behavior of Service components for performance assessment, maintenance and troubleshooting purposes;

  • Hosting and backend infrastructure: to host data that enables the CGM Products and/or Services to function;

  • Event service providers: which manage events for us;

  • Providing credit card binding and identity verification services as required by government authorities for you: these services will be provided by our third party payment service providers, identity verification service providers for credit card binding payments, the issuing banks and acquiring institutions of the credit cards you use to pay the relevant fees to us, credit card authorization and transaction processing centers, or other institutions to which we are legally required to provide your personal data by government authorities;

  • Other services: to provide CGM Products and/or Services to you, or for the performance of our agreement with you, or for enforcing our legitimate claims and other rights against you.

4. THIRD PARTY SDK

In order to enhance your experience and enable access to specific functionalities, certain CGM Products and/or Services incorporate Software Development Kits (“SDK”) provided by third parties. By utilizing these CGM Products and/or Services, you acknowledge that third party entities supplying the SDK may, independently from CGM, collect and process your personal data via the SDK. An example of this is when you activate the mapping and navigational features available on the iQ Touch HD; in such instances, the SDK provider HERE Global B.V. (“Here”) will collect and process some of your personal data through the SDK. For details regarding the collection and processing of your personal data, please refer to the Here SDK Privacy Supplement, as issued and updated by Here.

5. INTERNATIONAL PERSONAL DATA TRANSFERS

We may transfer your personal data to different countries/regions in compliance with the applicable privacy and personal data protection laws and regulations in such countries/regions, including the European Economic Area (“EEA”), Singapore and Japan, where the data centers of third party cloud services we use are located.

To fulfill the data processing purposes and on the lawful bases described in Section 2 of this Policy, your personal data may be transferred, stored, used or processed to and/or by CGM’s affiliated companies, vendors and any of its service providers who may be located in a different country/region from where you reside. All such transfer, storage, use or process of your personal data, shall be subject to the Policy and applicable privacy and personal data protection laws and information security regulations. We will put in place appropriate safeguards in accordance with applicable legal requirements to ensure that your personal data is adequately safeguarded and protected, and we may conduct assessments on personal data transfers.

We may obtain written assurances from any third party given access to your personal data so as to require them to adopt standards that ensure an equivalent level of protection for your data as that adopted by us.

6. WHEN WE START PROCESSING AND HOW LONG WE RETAIN YOUR PERSONAL DATA

We will start processing your personal data as soon as they are provided to us in accordance with this Policy and the regulations of the laws.

Generally, we will retain your personal data for the period necessary to fulfill the purposes herein in this Policy, in accordance with the lawful bases applicable to each purpose (including your consent, where required by law). Where applicable laws require or permit longer retention, we may retain your data for such extended periods.

For instance, we may retain your personal data within adequate and reasonable period for customer relationship management purpose where you have consented to such purposes. We may also retain your personal data for the periods prescribed by laws and regulations (such as tax, accounting, or other regulatory requirements), and for longer retention period where necessary to comply with requests orders from competent governmental or judicial authorities for purposes such as investigations, proceedings, or enforcement actions.

Where consent is the lawful basis for retention beyond the period strictly required to perform our contract with you or to comply with legal obligations, we will only retain your personal data for such extended period if and to the extent you have provided valid consent, and you may withdraw your consent at any time in accordance with this Policy.

7. YOUR RIGHTS AND OBLIGATIONS

Subject to the applicable local laws and regulations, you have the following rights in relation to your personal data. To exercise these rights, please contact us using the details at Section 13 of this Policy:

  • Right to access: You have the right to access your personal data processed by us in order to check or view such personal data. You also have the right to request a copy of the personal data we hold about you.

  • Right to rectify: If any of your personal data that we are processing is inaccurate or incomplete, you may request us to rectify it or to make the required corrections to it.

  • Right to erasure/delete: You may have your personal data erased/deleted from our database or anonymised if the processing is no longer necessary for the purposes pursued by us, or if, among other things, your personal data are being unlawfully processed.

  • Right to object: Under certain circumstances, pursuant to the applicable local laws and regulations, you may have the right to object to our processing of your personal data (for example, where the processing is carried out on the basis of our legitimate interests). Where we process your personal data for direct marketing purposes, you can exercise your right to object at any time without having to provide any specific reason for such objection, including demanding the cessation of the collection, processing or utilization of your personal data.

  • Right to restrict: The processing of your personal data can be restricted upon your request. In such circumstances, your personal data will not be further processed except with your consent, or except for the establishment, exercise or defense of a relevant legal claim or for the protection of the rights of another person.

  • Right to withdraw consent: If we process your personal data for a purpose for which the lawful basis is your consent or explicit consent, you may withdraw such consent at any time by notifying us.

  • Right to lodge a complaint: If you deem that your rights under the applicable local laws and regulations have been infringed, you have the right to lodge a complaint with the competent supervisory authority for data protection in Vietnam.

  • Other rights in accordance with the laws on data privacy of Vietnam from time to time.

The rights described above might be subject to the requirements and conditions provided by the applicable law and our policies and procedures. In certain cases, we may ask that you explain to us why you are making a specific request, or, if needed, confirm your identity. We may not be in a position to take actions at your certain requests, for example, where to do so would impede a criminal investigation.

Please note that these rights are not absolute, in some cases they will not apply to you, or to the particular use that we are making of your personal data, and there are exceptions, such as if we have to process the personal data to comply with our legal obligations), but we will let you know if you make a request that we believe we cannot comply with.

Any request from you for your above rights must be in writing or by other CGM assigned methods, and we will endeavor to respond within a reasonable or the statutory period after verifying your identity in compliance with the applicable privacy and data protection laws and regulations. We will comply with our legal obligations under the applicable laws and regulations with regard to your rights as a data subject.

You understand and agree that in accordance with applicable laws, we may have the right to charge you for a certain amount of fee depending on the complexity of your requests to cover our operational expenditure.

If there are other special requirements under the applicable laws and regulations in Vietnam, we will process your personal data in accordance with such applicable laws and regulations.

In accordance with applicable personal data protection laws in Vietnam, you, as a data subject, also have the following obligations in relation to your personal data: you must take appropriate measures to safeguard your own personal data; respect and not unlawfully interfere with the personal data of others; provide complete and accurate personal data about yourself as required by law, by contract, or when you consent to the processing of your personal data; and comply with personal data protection laws and, within your capacity, support the prevention and handling of personal data infringements.

8. CONSEQUENCES OF NOT PROVIDING PERSONAL DATA TO US

If you do not provide us with your personal data which are required for the CGM Products and/or Services, we will not be able to provide you with the CGM Products and/or Services. If you register for an account(s) but do not provide us with your personal data other than those personal data required for the registration, we will not be able to fully perform the service(s). If we are required to obtain your personal data in order to fulfill legal obligations to which we are subject, and you do not provide such information to us, we may not be able to accept your use of the CGM Products and/or Services.

9. COOKIE

We and/or our partners use tracking technologies such as cookies on our site to personalize content and ads, to provide social media features and to analyze our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you have provided to them or that they have collected from your use of their or other service(s).

You hereby consent to the use of this technology across the web. You can change your mind and change your consent choices at any time by returning to this site. If you choose to reject the use of this technology, the only tracking technology we will use is a light cookie function to memorize your choice regarding the cookie policy.

10. CHILDREN’S POLICY

We consider a child to be anyone under the equivalent age as specified by law in your jurisdiction (“Child(ren)”). We do not knowingly seek or collect personal data from or about Children without the consent of a parent or guardian and the consent of the Child.

If we become aware that personal data that has been submitted to us relates to a Child without the consent of a parent or guardian and the consent of the Child, we will use reasonable efforts to:

  • Delete that personal data from its files or make it anonymised as soon as possible.

  • Ensure, where deletion and anonymization is not possible, that this personal data is not used further for any purpose, nor disclosed further to any third party.

Any parent or guardian with queries regarding our processing of personal data relating to their Child should contact us using the details at Section 13 of this Policy.

11. PROTECTING YOUR PERSONAL DATA

We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure, we have put in place suitable physical, electronic, and managerial procedures to safeguard and secure the information we collect. Such measures will be appropriate to the nature of the data concerned and the level of risk. If you have been provided with a password to access any of our services you should not share that password with anyone else.

12. AMENDMENTS TO THIS POLICY

We may update this Policy from time to time on our official website to comply with legal requirements or to meet our changing business needs. Generally, such updated Policy shall take effect after such amended Policy is posted. We will inform you of material changes via pop-up notices and/or email and, where required by applicable law, we will seek your explicit consent before such changes take effect.

13. PRIVACY QUESTION

If you would like to exercise your privacy rights as set out in this Policy, or if you have any questions or suggestions about this Policy or our privacy and security measures, please contact us at the following e-mail address:

E-mail Address: [●]

This is an email address dedicated to privacy matters. If your inquiry is not related to privacy rights, please contact our company's customer service dedicated email address: [●]

We will respond to your request as soon as possible within the statutory period applicable to us.

© 2026 CGM and/or its affiliates. All rights reserved.


PERSONAL DATA PROCESSING CONSENT (Web/App)

This form allows you to choose and give your consent to specific personal data processing activities, as required under Vietnamese data protection laws.

Please read this form together with the Privacy Policy. By ticking the boxes and signing or submitting this form, you confirm that you understand how your personal data will be used and agree to the processing activities you choose. You also acknowledge that certain processing of your personal data is necessary for us to perform our agreements with you and to comply with applicable legal obligations.

Each purpose below is optional and independent. You can choose Agree or Do not agree for each purpose. You may change your choice or withdraw consent at any time in Settings or as described in the Privacy Policy.

Marketing from CGM

CGM can use your personal data (e.g. contact details, product/service usage) to send promotions, product or service updates, and invitations to CGM events.

Marketing about partner products or services

CGM can use your personal data to send information or marketing communications about products or services offered by CGM's partners.

Loyalty & customer relationship management (CRM)

CGM can retain and use your personal data beyond minimum legal or contractual requirements to manage loyalty or membership programs and customer relationships.

Personalization & profiling

CGM can analyze your preferences and use your data to personalize content, recommendations, or offers, including customer segmentation and profiling to improve relevance.

Analytics, service improvement & surveys

CGM can processing your personal data (including usage, interaction, and technical data) for analytics, reporting, improvement and development of CGM products/services/app/website, and surveys or user research.

Events & campaigns participation

CGM can process your personal data to manage your registration and participation in events, campaigns, or promotions hosted, co-hosted, or sponsored by CGM, including operational communications and follow-ups.

Optional features using third-party SDKs (e.g. maps/navigation)

CGM can process your personal data to enable optional features that rely on third-party SDKs. Third-party providers may process your data under their own privacy notices, which may include usage or location data and cross-border transfers.

By clicking “Submit”, you confirm that you have read and understood the Privacy Policy and that your choices above reflect your consent preferences.

Language Switch:
Zalo