Last updated: 3 June 2026 This Privacy Policy explains how First principles MB collects, uses, stores and protects personal data when you use the Kas Varo mobile application, services, features and related communications. For the purposes of this Privacy Policy, "Kas Varo", "we", "us" or "our" means: First principles MB Company code: 307581415 Registered address: Girulių g. 22, Lithuania Email: info@firstprinciples.lt Kas Varo is a carpooling platform that allows users to publish, search for, reserve and manage carpool trips. Drivers and passengers use Kas Varo to arrange shared travel and split travel-related costs. Kas Varo is not a transport company, taxi operator, ride-hailing service or passenger carrier. 1. Who is responsible for your personal data? First principles MB is the data controller for personal data processed through Kas Varo, unless stated otherwise. For privacy-related questions or requests, you may contact us at: info@firstprinciples.lt 2. Personal data we collect Depending on how you use Kas Varo, we may collect and process the following categories of personal data. 2.1 Account data This may include: - name; - email address; - phone number; - password or authentication data; - social sign-in provider identifiers and authentication information, where you choose to sign in with Google, Apple or another provider; - account status; - profile photo; - user role, such as passenger, driver or both; - language, country and app preferences; - account creation date; - account activity information; - privacy policy and terms acceptance records. 2.2 Driver profile and vehicle data If you use Kas Varo as a driver, we may collect: - full name; - vehicle make, model, color and other vehicle details; - car photo; - vehicle registration plate number; - driver profile information; - payout onboarding status; - ride history; - driver activity and performance information; - information needed to help passengers identify the correct vehicle. 2.3 Carpool trip and booking data We process data related to carpool trips, including: - trip origin and destination; - route information; - pickup and drop-off information; - pickup addresses or coordinates provided for bookings; - trip date and time; - seat availability; - trip price; - booking status; - cancellation status; - passenger and driver participation; - trip completion status; - dispute or refund status; - timestamps related to booking, cancellation, payment, completion and dispute events. 2.4 Location and route data Kas Varo may process location-related data such as: - pickup and destination points entered by users; - pickup addresses or coordinates provided for bookings; - current, last-known or selected device location when you use location-based features; - route information and directions requests; - address, city, place search, geocoding and reverse-geocoding queries; - location data captured for trip start, cancellation, completion, reports, disputes or safety features where relevant; - approximate location derived from app use; - location data needed to display maps, calculate routes, match carpool trips or support safety features. Where map, routing or place-search providers are used, they may receive search terms, selected addresses or places, coordinates, route endpoints and related technical data needed to provide those features. We do not intend to continuously track your location unless a feature clearly requires it and you have granted the necessary permission. You may be able to control location permissions through your device settings. If you disable location permissions, some app features may not work correctly. 2.5 Payment and payout data Payments may be processed by third-party payment providers, such as Stripe, Apple Pay or Google Pay. We may process: - payment status; - payment amount; - payment method type and limited payment method metadata; - transaction identifiers and payment provider reference numbers; - refund status; - transfer status; - chargeback or payment dispute status; - payout status; - service fees; - booking fees; - limited payment metadata; - payment provider failure, compliance, onboarding or account status. Kas Varo does not store full card numbers or full payment card details. If you are a driver, our payment provider may collect additional identity, tax, bank account, compliance or verification data directly from you for payout onboarding and regulatory purposes. 2.6 Messages and user-generated content Kas Varo may process content you submit through the app, including: - in-app messages; - trip descriptions; - reviews or ratings; - profile content; - uploaded images; - support messages; - reports, complaints and dispute information; - blocked-user records; - moderation, safety and enforcement records. We may use automated and manual moderation and safety checks to detect abuse, fraud, illegal content, spam, unsafe behavior, harassment or policy violations. 2.7 Image and verification-related data Kas Varo may process uploaded images, including: - profile photos; - vehicle photos; - other photos submitted for app features, safety, support, verification or moderation. We may use automated or manual checks to verify whether submitted images are relevant, appropriate, safe and consistent with the intended feature. 2.8 Device, technical and usage data We may collect: - device type; - operating system; - app version; - IP address; - crash logs; - error logs; - security logs; - device identifiers; - push notification tokens; - usage events; - performance data; - approximate diagnostic information. This helps us operate, secure, debug and improve Kas Varo. 2.9 Support and communication data When you contact us, we may process: - your contact details; - message content; - attachments; - support history; - complaint details; - dispute details; - technical information needed to investigate your issue. 3. Why we process your personal data We process personal data for the following purposes. 3.1 To create and manage your account We use account data to register users, authenticate access, support social sign-in where you choose to use it, manage profiles and provide app features. Legal basis: performance of a contract and legitimate interest. 3.2 To provide carpooling features We use trip, route, profile and booking data to let users publish carpool trips, search for trips, reserve seats, manage bookings, communicate and complete trips. Legal basis: performance of a contract. 3.3 To process payments, refunds and payouts We process payment and payout data to collect payments, apply fees, process refunds, release funds to drivers, handle disputes and keep transaction records. Legal basis: performance of a contract, legal obligation and legitimate interest. 3.4 To support safety, trust and fraud prevention We may process account, trip, message, device, payment, image, report, block and moderation data to detect fraud, abuse, unsafe behavior, suspicious activity, policy violations or unauthorized use. Legal basis: legitimate interest, legal obligation and performance of a contract. 3.5 To provide customer support We process support messages and related account, trip, payment or technical data to respond to questions, investigate issues, handle disputes and resolve complaints. Legal basis: performance of a contract and legitimate interest. 3.6 To send service communications We may send transactional or service-related messages, such as: - booking confirmations; - trip updates; - cancellation notices; - payment updates; - refund updates; - payout updates; - account notices; - security notices; - support replies; - policy updates. Legal basis: performance of a contract and legitimate interest. 3.7 To send optional marketing communications If we send marketing communications, we will do so only where permitted by law, based on your consent or another valid legal basis. You may opt out of marketing communications at any time. Legal basis: consent or legitimate interest, depending on the communication. 3.8 To improve and develop Kas Varo We may use technical, usage, support and aggregated data to understand how the app works, fix bugs, improve performance, develop features and improve user experience. Legal basis: legitimate interest. 3.9 To comply with legal obligations We may process and retain certain data to comply with accounting, tax, consumer protection, fraud prevention, payment, law enforcement or regulatory obligations. Legal basis: legal obligation. 4. Who we share personal data with We may share personal data with the following categories of recipients where necessary. 4.1 Other Kas Varo users To make carpool trips possible, some data is shared between drivers and passengers, such as: - name; - profile photo; - trip details; - pickup or destination information; - pickup address or coordinates needed for the trip; - vehicle details; - vehicle registration plate or similar vehicle information where needed to identify the correct vehicle; - messages; - booking status; - rating or review information. 4.2 Payment providers We may share payment-related data with payment providers such as Stripe, Apple Pay or Google Pay to process payments, refunds, payouts, identity checks, payment disputes, fraud prevention and compliance obligations. Payment providers may act as independent controllers for certain data they process for legal, regulatory, fraud prevention and payment network purposes. 4.3 Sign-in providers If you choose to sign in with a third-party provider such as Google or Apple, we may receive and share the account, authentication and verification information needed to create, connect, secure or revoke that sign-in method. Those providers may process data under their own terms and privacy policies. 4.4 Hosting, infrastructure and technical providers We may use third-party providers for: - hosting; - databases; - analytics; - crash reporting; - push notifications; - maps; - routing; - email delivery; - security; - monitoring; - operational infrastructure. These providers process data only where necessary to provide their services to us. 4.5 Moderation, safety and anti-fraud providers We may use service providers or tools that help us detect suspicious behavior, unsafe content, fraud, spam, abuse or technical misuse. 4.6 Support, legal and professional advisers We may share data with advisers, auditors, accountants, lawyers, insurers or other professional service providers where necessary. 4.7 Authorities and legal requests We may disclose personal data if required by law, court order, regulator request, law enforcement request, payment provider request or where necessary to protect our rights, users or the public. 5. International transfers Some service providers may process personal data outside Lithuania or the European Economic Area. Where this happens, we use appropriate safeguards required by applicable law, such as standard contractual clauses or other lawful transfer mechanisms. 6. How long we keep personal data We keep personal data only for as long as necessary for the purposes described in this Privacy Policy. Typical retention periods include: - account data: while your account exists; - trip and booking data: for as long as needed for service operation, dispute handling, accounting and legal obligations; - payment and invoice-related records: for the period required by tax, accounting and financial laws; - support messages: for as long as needed to resolve issues and maintain records; - moderation and safety data: for as long as needed to protect users, investigate abuse and enforce our Terms; - technical logs: for a limited period unless needed for security, fraud prevention, debugging or legal purposes; - push notification tokens: while needed to send app notifications or until they are no longer valid. When data is no longer needed, we delete it, anonymize it or securely retain it only where legally required. 7. Your rights Subject to applicable law, you may have the right to: - access your personal data; - correct inaccurate personal data; - request deletion of your personal data; - restrict processing of your personal data; - object to certain processing; - request data portability; - withdraw consent where processing is based on consent; - lodge a complaint with a data protection authority. To exercise your rights, contact us at: info@firstprinciples.lt We may need to verify your identity before responding to your request. 8. Data protection authority If you believe that your personal data has been processed unlawfully, you may contact the Lithuanian State Data Protection Inspectorate or another competent data protection authority. Lithuanian State Data Protection Inspectorate: https://vdai.lrv.lt/ 9. Account deletion You may request deletion of your account by contacting us at info@firstprinciples.lt or by using any account deletion feature available in the app. When your account is deleted, we may delete, disable, disconnect or anonymize account profile details, login credentials, active sessions, device tokens, uploaded account media and social sign-in links. Some trip, booking, payment, payout, refund, message, report, moderation, safety, support and technical records may be retained after account deletion where necessary for legal, accounting, fraud prevention, payment, chargeback, dispute resolution, safety or legitimate business purposes. Where possible, retained records are limited or anonymized. 10. Security We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or disclosure. However, no system is completely secure. You are responsible for keeping your login credentials confidential and for using a secure device. 11. Automated moderation and safety checks We may use automated systems to help detect: - spam; - fraud; - unsafe content; - prohibited content; - fake profiles; - suspicious payment activity; - abusive messages; - invalid uploaded images; - policy violations. Automated systems may flag content or accounts for review. We may restrict, suspend or remove content or accounts where we believe there is a violation of our Terms, safety rules or applicable law. 12. Push notifications If you allow push notifications, we may send notifications about bookings, messages, trip updates, cancellations, payments, safety notices, account activity and other service-related matters. We use push notification tokens only where needed to send app notifications and may share them with push notification providers such as Apple Push Notification service or Firebase Cloud Messaging. You can control push notification permissions through your device settings. 13. Changes to this Privacy Policy We may update this Privacy Policy from time to time. If changes are material, we may notify you through the app, by email or by other appropriate means. The updated version will apply from the date stated at the top of the policy. 14. Contact For questions about this Privacy Policy or your personal data, contact: First principles MB Company code: 307581415 Address: Girulių g. 22, Lithuania Email: info@firstprinciples.lt