Data Rights

MAPFOUR Policy on Data Access, Export, Transfer, and Deletion

(Applicable to e-bikes connected to MAPFOUR and its associated app services.)

Article 1 Purpose and Scope

1.1 These provisions explain how MAPFOUR provides users with options for accessing, exporting, authorized disclosure to third parties, deleting, and receiving appropriate support regarding data generated or processed by connected electric bikes and their associated digital services.

1.2 These rules apply to:

(1) Connected electric bicycles of the MAPFOUR brand;

(2) MAPFOUR app services directly related to the functions of these products;

(3) User requests regarding access, export, transfer, withdrawal of consent, and deletion of data generated by the aforementioned products and services.

1.3 These rules do not apply in the following cases:

(1) Purely internal administrative data not directly related to product functions;

(2) Data used exclusively for internal purposes related to cybersecurity, fraud prevention, audits, product troubleshooting, or research and development analysis, which may not be fully disclosed externally in accordance with legal provisions;

(3) Data independently managed by third-party platforms or by third parties, unless MAPFOUR specifies otherwise within its own sphere of influence.

Article 2 Definitions

Unless the context indicates otherwise, the following terms in these rules have the meanings specified below:

2.1 Product: refers to network-connected electric bicycles of the MAPFOUR brand, including integrated or external IoT modules, sensors, control systems, and other components that can generate or transmit data during use.

2.2 Related services: refers to digital services directly related to product functions, including the MAPFOUR app and the necessary backend support services.

2.3 User: a natural person, legal entity, or other organization that acquires, leases, receives through transfer, is authorized to use, or actually controls the product and is authorized to use the associated services.

2.4 Data access: refers to a user directly viewing online or otherwise obtaining data related to the use of their product or associated services.

2.5 Data export: refers to MAPFOUR making data available to eligible users in a structured, commonly used, and machine-readable format.

2.6. Third-party recipient: refers to a third party to whom MAPFOUR may provide certain data upon the express request or with the express consent of the user, such as a repair company, maintenance company, insurance company, fleet manager, or other service provider lawfully designated by the user.

2.7 Authorized disclosure: refers to MAPFOUR providing relevant data to a third party based on a request from or with the consent of the user, in accordance with the specified scope, purpose, and period.

2.8 Restricted data: refers to data that, due to network and product security, trade secrets, authentication mechanisms, system integrity, protection of third-party rights and interests, or other legitimate reasons, may not be fully disclosed in its original form.

Article 3 Scope of data

3.1 During the use of the product and its associated services, MAPFOUR may generate, receive, record, store, or process the following categories of data:

(I) Vehicle operation and status data.

Including, but not limited to: real-time speed, maximum speed, average speed, partial mileage, partial time, remaining range, total mileage, total riding time, assistance level, real-time motor power, real-time motor torque, main battery charge level 1, battery charge level 2, battery charge level 3, battery voltage, real-time cadence, average cadence per ride, real-time muscle power, real-time pedal torque, CAN error codes, display error codes, headlight switch status, turn signal switch status, connection status, signal strength, IoT box charge level, number of GPS satellites, vehicle lock status, power on/off status, charge level, etc.

(II)Device identification and connection data

This includes, but is not limited to: device name, device model, serial number, MAC address, version number, software version, sensor data, status, and security mode.

( III ) Location and route data

This includes, but is not limited to: mobile device location data, precise vehicle position, location data related to navigation, driving routes, and route history.

(IV)Account and basic profile data

This includes, but is not limited to: email address, password, country/region, nickname, avatar, or profile picture.

(V)Feedback, customer service, and support data

This includes, but is not limited to: the user's email address or other contact information, device name, user's country, problem type, feedback text, feedback photos, log files, or diagnostic data directly related to identifying the problem.

(VI)Community and user-generated content

This includes, among other things: photos uploaded by users to the community, comments, content created using image editing, and other content actively published by users.

(VII)Protocols and operational security data

Including log information about the operation, troubleshooting, security assurance, and system integrity of the app and backend services.