This Privacy Notice explains how Appboxo Pte. Ltd. (“Boxo”, “we”, “us”, or “our”) collects, uses, shares, and protects your personal data when you use the Airport Rides service (the “Service”) made available as a miniapp within the Revolut application (the “Revolut App”). It is the Privacy Notice referred to in the Airport Rides Terms and Conditions (the “Terms”) and should be read together with them; capitalised terms not defined here have the meaning given in the Terms.

The Service lets you (the “End User”) search, compare, book, and manage point-to-point ground transportation (a “Transfer”) performed by independent third-party transportation companies (each a “Carrier”). For the personal data we process to provide the Service, Boxo is an independent data controller. Revolut and each Carrier are separately responsible, as independent controllers, for the personal data they process for their own purposes.

We provide the Service to users in several countries whose laws differ. This Notice gives a general overview, and Sections 11 and 12 provide additional information for users in the EEA, the United Kingdom, Switzerland, and Singapore.

Who we are

Boxo is Appboxo Pte. Ltd., a company incorporated in Singapore (UEN 201932809W), with its registered office at 68 Circular Road, #02-01, Singapore 049422. We are the controller of the personal data processed through the Service. Because we are established in Singapore, personal data we receive about EEA, UK, or Swiss users is transferred internationally as described in Section 6 and Section 11.

Personal Data We Collect — At a Glance

To provide the Service, we collect and use the following categories of personal data. Each is explained further in Sections 1 to 3.

• Identity and contact data: your name, email address, telephone number, and account or messaging identifiers.

• Booking and trip data: pickup and drop-off addresses and locations, flight, train, or vessel number, travel dates and times, number of passengers and luggage, vehicle category, add-ons, booking reference, and trip status.

• Payment and transaction data: the Fare, currency, payment status, refunds, and chargebacks. We do not collect or store your full payment-card details (see Section 3).

• Accessibility data: where you tell us a Passenger uses a wheelchair or needs related assistance, so the Transfer can be arranged appropriately. This may be special-category or sensitive data and is handled only for that purpose (see Sections 1 and 11).

• Passenger data: where you book on behalf of another person, the name and contact and trip details of that Passenger, which you confirm you are authorised to provide.

• Device and usage data: IP address, device and app information, unique identifiers, screens viewed, and diagnostic data.

• Support and communications data: your support chats, emails, and calls, which may be recorded, and our responses.

1. How We Collect Your Personal Data

Data you provide

When you make or manage a booking or contact support, you provide identity and contact details, trip details (pickup and drop-off, flight number, dates and times, passengers and luggage), vehicle and add-on choices, any accessibility or other special requests, and the content of your communications with us. You are responsible for the accuracy of the information you provide, including any data about another Passenger.

Data we receive from Revolut

Because you access the Service through the Revolut App, we receive certain personal data from Revolut to enable and fulfil your booking, typically your identity and contact details and an authentication token where you sign in using Revolut single sign-on. Revolut’s handling of your personal data is governed by Revolut’s own privacy policy.

Data we collect automatically

When you use the Service we and our service providers automatically collect device and usage data, including IP address, device and app identifiers, the screens you view, and diagnostic information, to operate, secure, and improve the Service.

Special-category and children’s data

We do not seek special-category data except where you provide accessibility information so that a suitable vehicle and assistance can be arranged. The Service is for adults aged 18 or over; we do not knowingly collect data from children except as part of a booking made by an adult (for example, a child travelling as a Passenger). See Section 5.

2. How We Use Your Personal Data and Our Legal Bases

We use your personal data to:

• create, confirm, and manage your bookings and provide the Service;

• arrange and coordinate your Transfer with the relevant Carrier, including flight tracking and pickup adjustments, and keep you informed (confirmations, vouchers, pickup instructions, and service updates);

• process the Fare, refunds, cancellations, no-show charges, and chargebacks;

• provide customer support and handle complaints and disputes, including liaising with the Carrier on your behalf;

• maintain the security, integrity, and performance of the Service and detect and prevent fraud, abuse, and misuse;

• analyse and improve the Service and develop new features;

• send you service messages and, where permitted, marketing about similar services, from which you can opt out at any time; and

• comply with legal obligations and establish, exercise, or defend legal claims.

Where data protection law (including the UK GDPR, the EU GDPR, the Swiss FADP, and the Singapore Personal Data Protection Act 2012) applies, we rely on these legal bases:

• Performance of a contract: to take steps at your request and to arrange, deliver, and support the Transfer you have booked.

• Legitimate interests: to operate, secure, and improve the Service, prevent fraud, and carry out limited marketing of similar services, where not overridden by your rights.

• Legal obligation: to meet our tax, accounting, anti-money-laundering, and other legal and regulatory duties.

• Consent: for certain marketing, non-essential cookies, and any accessibility data that is special-category data; you may withdraw consent at any time.

3. Who We Share Your Personal Data With

We share personal data with the following recipients to provide the Service:

• Carriers. We share the data the Carrier needs to perform your Transfer — including the Passenger’s name, contact telephone number, pickup and drop-off details, flight or vessel number, and any special or accessibility requests. Each Carrier acts as an independent data controller of that data.

• Revolut. We share booking, transaction, and service data with Revolut as necessary to operate the Service within the Revolut App and to reconcile payments. The data Revolut shares with us and that we share with Revolut is governed by your agreement with Revolut and this Notice.

• Payment processing (Revolut Pay / “RevPay”). Payment for the Service is processed through Revolut Pay. We do not collect or store your full payment-card details; that data is handled by the payment processor under its own privacy policy and the PCI-DSS standard.

• Service providers. We use vetted providers (for example hosting, monitoring and error tracking, communications, analytics, and fraud prevention) that process personal data on our behalf, under contract, and only as needed to perform their services for us.

• Legal, safety, and compliance. We may disclose data where we believe in good faith it is necessary to comply with law or a lawful request, enforce the Terms, prevent or investigate fraud or wrongdoing, protect the safety or rights of any person, or defend legal claims.

• Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, personal data may be transferred to the parties involved, subject to appropriate confidentiality protections.

We do not sell your personal data and we do not share it for cross-context behavioural or interest-based advertising.

We maintain a current list of the sub-processors and service providers that process personal data for the Service (for example, our hosting, monitoring, analytics, support and transport-fulfilment providers). That list is available on request using the contact details in Section 10.

4. Your Choices

• You can opt out of marketing at any time using the unsubscribe link or by contacting us.

• You can choose not to provide certain data, although this may prevent us from completing a booking or arranging a Transfer.

• You can exercise the data protection rights described in Sections 10 and 11.

  
  

5. Children

The Service is intended for individuals aged 18 or over. We do not knowingly collect personal data from children except where it forms part of a booking made by an adult (for example, a child travelling as a Passenger). If we learn that we have collected a child’s data without appropriate authorisation, we will delete it. If you believe a child has provided us with personal data, please contact us.

6. International Transfers

Boxo is based in Singapore. Where you access the Service from the EEA, the UK, or Switzerland, your personal data is transferred to and processed in Singapore, and may be accessed by our service providers and Carriers in other countries to arrange and perform your Transfer.

Where we transfer personal data out of the EEA, the UK, or Switzerland to a country not recognised as providing an adequate level of protection, we put appropriate safeguards in place. For transfers from Revolut to Boxo, these are set out in a Data Transfer Agreement incorporating the European Commission’s Standard Contractual Clauses (controller-to-controller, Module One), the UK International Data Transfer Addendum, and the Swiss Addendum. You may request a copy of the relevant safeguards using the details in Section 10.

7. How We Protect Your Personal Data

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls and least-privilege access, network segmentation, logging and monitoring, secure development practices, and incident-response procedures. We notify the relevant parties and, where required, authorities and affected individuals of personal-data breaches in accordance with applicable law. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purposes in this Notice, then delete or anonymise it. In particular:

• Booking and transaction records are kept for the period required by tax, accounting, and anti-money-laundering law (typically 7 years from the transaction).

• Support and complaint records are kept for 24 months from resolution of the case, and longer where needed to handle a dispute or legal claim.

• Marketing data is kept until you unsubscribe or withdraw consent, and a short period afterwards to honour your preference.

• Device and usage data is generally kept for a shorter period, except where needed for security, fraud prevention, or a legal obligation.

We may keep data longer where necessary to establish, exercise, or defend legal claims, or to meet a legal obligation.

9. Cookies and Similar Technologies

The Service operates within the Revolut App and does not use cookies to serve interest-based advertising. We and our service providers may use device identifiers, SDKs, and similar technologies to operate, secure, and analyse the Service. Where you also use our website, our separate website cookies notice applies.

10. How to Contact Us

To ask about this Notice or to exercise your data protection rights, contact us:

• by email: privacy@boxo.io

• by post: Appboxo Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422

We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law.

11. Additional Information for the EEA, the UK, and Switzerland

This section supplements the Notice and applies to individuals in the EEA, the UK, and Switzerland. Where it conflicts with the rest of the Notice, this section prevails for those individuals.

Controller and representatives

Boxo (Appboxo Pte. Ltd.) is the controller of the personal data it processes through the Service. As Boxo is established outside the EEA, the UK, and Switzerland, it has appointed representatives under Article 27 of the EU GDPR, Article 27 of the UK GDPR, and Article 14 of the Swiss FADP.

We value your privacy and your rights as a data subject and have appointed Prighter Group, with its local partners, as our privacy representative and your point of contact for the United Kingdom, Switzerland, and the European Union. To exercise your privacy-related rights (for example, to access or erase your personal data), or to contact us via Prighter, please visit https://app.prighter.com/portal/boxo.

• EU representative: PrighterGDPR-Rep by Maetzler Rechtsanwalts GmbH & Co KG, c/o Appboxo Pte. Ltd., Schellinggasse 3/10, 1010 Vienna, Austria.

• UK representative: PrighterUK-Rep by Prighter Ltd, c/o Appboxo Pte. Ltd., Kemp House, 160 City Road, London EC1V 2NX, United Kingdom.

• Swiss representative: Prighter Group and its local Swiss partner, c/o Appboxo Pte. Ltd.; contactable via the Prighter portal above.

  
  

Your rights

Subject to the conditions and exceptions in applicable law, you may: access your personal data; have inaccurate or incomplete data corrected; request erasure; object to processing (including direct marketing); request restriction; request portability; and withdraw consent where processing is based on consent. You may also complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EEA, your local data protection authority; and in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

International transfers

As described in Section 6, transfers of your personal data to Singapore or other non-adequate countries are protected by the Standard Contractual Clauses (controller-to-controller, Module One), the UK International Data Transfer Addendum, and the Swiss Addendum, or another lawful transfer mechanism. You may request a copy using the details in Section 10.

12. Additional Information for Singapore

Where the Singapore Personal Data Protection Act 2012 (“PDPA”) applies, we collect, use, and disclose personal data in accordance with the PDPA. You may request access to, or correction of, your personal data, and you may withdraw consent, by contacting us using the details in Section 10. Withdrawing consent may affect our ability to provide the Service. Our data protection contact for PDPA matters is privacy@boxo.io.

This Privacy Notice forms part of, and should be read with, the Airport Rides Terms and Conditions. Effective date: 23 June 2026