Privacy Policy

Effective date: July 11, 2026

The very short version

We rent small electric vehicles. To do that safely, we need to know who is driving, how to reach them, and where our vehicles are.

We do not sell your personal information. We cannot see your full credit card number. We are also not interested in following you around the internet after your HeyYa adventure ends. Frankly, we have enough trouble keeping track of the carts.

The official, less entertaining version begins below.

-·· ·· ··· -·-· — ··- -· – -·-· — -·· · ·-· · ·- -·· – ···· · ··-· ·· -· · ·–· ·-· ·· -· –

1. About this policy

This Privacy Policy explains how HeyYa Rentals Inc. and its related companies, including HeyYa Carts Inc., HeyYa Tours Inc., and HeyYa Franchising Inc., collect, use, disclose, store, and protect personal information.

Together, these companies operate under the public-facing name HeyYa Carts. In this policy, “HeyYa,” “we,” “us,” and “our” refer to these companies, as applicable.

This policy applies to:

• heyya.ca and its subdomains;

• our rental, pickup, return, petition, tour, corporate, franchise, employment, contest, referral, loyalty, gift card, investor, and other forms or programs;

• reservations made online, by telephone, by text message, by email, through a booking marketplace, or in person;

• the operation and monitoring of our vehicles;

• communications with customers and prospective customers; and

• other services, programs, websites, and interactions operated by HeyYa.

Our handling of personal information is governed primarily by British Columbia’s Personal Information Protection Act and, where applicable, other Canadian privacy laws.

2. What is personal information?

Personal information is information about an identifiable individual.

It can include a person’s name, contact information, driver information, photograph, identity-verification information, booking history, vehicle location associated with a rental, communications with us, accident information, payment records, and other information that can reasonably be connected to that person.

Personal information does not generally include information that has been anonymized so that it can no longer reasonably identify an individual.

3. Accountability

HeyYa is responsible for personal information under its control.

Our Chief Operating Officer serves as our Privacy Officer and is responsible for overseeing our privacy practices and responding to privacy questions, requests, and complaints.

Privacy Officer
HeyYa Carts
1040 West Pender Street, Box 46
Vancouver, British Columbia V7X 1M3
Canada

Email: admin@heyya.ca
Telephone: +1-236-624-3992

4. Information we collect

The information we collect depends on how a person interacts with HeyYa.

4.1 Rental and driver information

When someone reserves, picks up, operates, or returns a HeyYa vehicle, we may collect:

• full legal name;

• residential address;

• email address;

• telephone number;

• date of birth;

• all information shown on the person’s driver’s licence;

• driver’s licence number, issuing jurisdiction, class, and expiry date;

• photographs or copies of the front and back of the driver’s licence;

• a selfie or other facial image used for identity verification;

• information generated through identity verification and liveness testing;

• booking dates and times;

• pickup and return locations;

• vehicle number and licence plate;

• rental history;

• signatures and rental agreement records;

• information about additional drivers;

• payment transaction information;

• security deposit or pre-authorization information;

• information about damage, accidents, tickets, late returns, prohibited use, or other rental incidents;

• photographs or videos submitted or created in connection with pickup, return, damage, or an incident;

• customer service communications and booking notes;

• hotel, cruise ship, event, corporate, or travel information where relevant to the rental;

• information about insurance policies or claims where relevant;

• information concerning prior rental conduct or eligibility; and

• accessibility requests or other special requests voluntarily provided by the customer.

For cruise-related reservations, we may ask for the name of the customer’s cruise ship so that we can coordinate the reservation.

Every driver must provide their own driver’s licence information. A renter may provide another driver’s information only by supplying a copy of that driver’s licence and confirming that they are authorized to do so.

We do not normally require passports or separate proof-of-residence documents.

4.2 Identity verification

We use a third-party identity-verification service to help confirm that a driver’s licence is valid and that the person presenting it is the person shown on the identification.

This process may include:

• analysis of the driver’s licence;

• a photograph or selfie;

• facial comparison;

• liveness testing intended to determine whether a real person is present; and

• fraud, authenticity, or risk indicators generated during verification.

Our current identity-verification provider is Didit. We may replace this provider or use another qualified provider in the future.

Identity verification is necessary to reduce fraud, confirm driver eligibility, protect our vehicles, and satisfy legal, insurance, payment, and operational requirements.

A person who does not complete required identity verification may not be able to rent or operate a HeyYa vehicle.

4.3 Payment information

Payments are processed by a third-party payment processor. HeyYa currently uses Stripe.

HeyYa does not receive or store a customer’s complete payment-card number, security code, or full payment credentials.

We may receive and retain:

• cardholder name;

• billing information;

• payment-card type;

• final digits of the card;

• transaction records;

• payment status;

• refund and dispute information; and

• a payment processor customer identifier or payment-method token.

The customer identifier or token may permit HeyYa to request authorized charges through the payment processor for amounts arising under the rental agreement, including:

• rental charges;

• extensions;

• damage;

• traffic or parking tickets;

• late returns;

• loss;

• cleaning;

• recovery costs;

• chargeback-related costs; and

• other amounts authorized by the rental agreement.

Payment information is also subject to the payment processor’s own privacy policy and terms.

4.4 Vehicle location and telematics

HeyYa vehicles may contain GPS and telematics equipment. We currently use PlanetGPS.

Depending on the vehicle and equipment, telematics information may include:

• current and historical vehicle location;

• routes travelled;

• speed;

• distance travelled;

• battery level;

• ignition or operating status;

• acceleration and braking events;

• collision or impact indicators;

• geofence entries and exits;

• vehicle diagnostics;

• tampering or disconnection events; and

• other vehicle-performance or usage information.

Authorized HeyYa personnel may view a vehicle’s location while it is rented.

We use this information to:

• manage our fleet;

• locate available, overdue, lost, stolen, or unreturned vehicles;

• provide emergency assistance and customer support;

• monitor battery status and maintenance requirements;

• investigate accidents, damage, unsafe use, prohibited use, fraud, theft, or breaches of a rental agreement;

• recover HeyYa property;

• respond to insurance, legal, regulatory, or law-enforcement matters;

• plan vehicle deployment and service locations;

• analyze vehicle use and improve our services; and

• protect customers, passengers, the public, our staff, our vehicles, and our business.

HeyYa vehicles do not currently contain customer-facing interior cameras, dashcams, or microphones.

We may introduce additional safety or vehicle-monitoring equipment in the future. Where appropriate, we will provide notice before doing so.

4.5 Pickup, return, damage, and incident information

Customers and staff may take or upload photographs or videos during pickup, return, inspection, accident, or damage reporting.

These images may incidentally contain:

• customers or passengers;

• bystanders;

• personal belongings;

• licence plates;

• streets, buildings, or other locations; and

• other personal information visible in the surrounding area.

We ask customers and staff to avoid including unrelated people or personal information wherever reasonably possible.

4.6 Accidents, insurance, witnesses, and third parties

When a collision, accident, damage event, injury, theft, or other incident occurs, we may collect information about customers and other people involved.

This may include:

• names and contact information;

• driver’s licence details;

• vehicle registration and licence plate information;

• insurance company and policy information;

• claim numbers;

• adjuster information;

• photographs and videos;

• police reports and police file numbers;

• witness names and statements;

• passenger information;

• information about injuries or medical treatment;

• descriptions of property damage;

• correspondence with insurers, lawyers, police, repair providers, or other parties; and

• other information reasonably required to investigate and resolve the incident.

This information may relate to renters, additional drivers, passengers, witnesses, other motorists, vehicle owners, pedestrians, cyclists, police officers, emergency responders, or other third parties.

4.7 Website and device information

When a person visits our website or uses an online form, we or our service providers may automatically collect:

• IP address;

• browser type;

• device type;

• operating system;

• approximate geographic location;

• language;

• referring website;

• pages viewed;

• links selected;

• date and time of access;

• form activity;

• session and diagnostic information; and

• cookies, pixels, or similar technical identifiers.

We use this information to:

• operate and secure our website;

• troubleshoot technical issues;

• improve website performance and usability;

• understand how the website is used;

• measure advertising and marketing performance; and

• prevent fraud or abuse.

4.8 Analytics, advertising, and embedded services

Our website may use analytics and advertising services provided by companies such as Google and Meta.

These services may use cookies, pixels, or similar technologies to collect information about visits to our website and interactions with our advertisements.

Depending on a person’s browser, device, and account settings, these providers may connect that activity with other information they hold.

We may also embed or link to third-party services, including:

• maps;

• videos;

• social-media content;

• CAPTCHA or anti-fraud tools;

• reviews;

• booking tools;

• payment tools; and

• other interactive website services.

Those providers may collect information directly from the user under their own privacy policies.

HeyYa does not currently upload customer contact lists to advertising platforms to create custom or matched advertising audiences.

Users may manage cookies and similar technologies through their browser settings and, where available, through settings offered by Google, Meta, or other service providers.

Blocking some technologies may affect the operation of parts of the website.

4.9 Communications

When a person contacts HeyYa or communicates with us during a reservation, we may collect and retain:

• emails;

• text messages;

• telephone numbers;

• voicemail messages;

• voicemail transcripts;

• customer service notes;

• call details;

• correspondence;

• attachments; and

• the date, time, sender, recipient, and delivery status of communications.

Telephone calls are not routinely recorded automatically. Voicemail messages may be recorded and transcribed.

We use communication services that may include email, telephone, text messaging, customer-support, workflow, and integration providers.

4.10 Text messages

We use text messages for operational communications relating to reservations and rentals.

These messages may include:

• booking confirmations;

• pickup instructions;

• vehicle and licence plate information;

• lockbox codes;

• safety instructions;

• return reminders;

• rental-extension information;

• payment or receipt information;

• customer support communications;

• damage or incident communications; and

• other information required to administer a rental.

Messages are usually sent from +1-236-624-3992. Messages may also be sent from a location-specific number or by an authorized HeyYa staff member.

Message and data rates may apply. Message delivery depends on the customer’s wireless carrier, device, network availability, and other factors outside HeyYa’s control. Wireless carriers are not responsible for delayed or undelivered messages.

Customers may reply STOP to opt out of further text messages and HELP for assistance, where supported by the messaging service.

A self-serve customer must remain reachable by either email or SMS throughout the reservation and rental period.

SMS generally provides the fastest and most convenient access to pickup and return instructions. A customer who opts out of SMS may receive information by email or telephone instead and may experience delays or a less convenient rental process.

Opting out of SMS does not prevent HeyYa from contacting a customer by email, telephone, or another reasonable method where necessary to:

• administer an active reservation or rental;

• address an emergency or safety issue;

• respond to an overdue or unreturned vehicle;

• recover HeyYa property;

• investigate an accident, damage, fraud, or prohibited conduct;

• collect an outstanding amount; or

• meet a legal or contractual obligation.

4.11 Information received from other organizations

We may receive a customer’s name, email address, telephone number, reservation details, or other relevant information from:

• hotels;

• concierges;

• tourism partners;

• cruise or transportation partners;

• event organizers;

• corporate customers;

• referral partners;

• travel coordinators;

• online booking marketplaces, including Viator; and

• other people or organizations that arrange a rental or service on the customer’s behalf.

Information received from a booking marketplace may include:

• customer contact information;

• reservation dates and times;

• party size;

• rental or tour selections;

• special requests;

• booking status;

• payment status; and

• marketplace confirmation numbers.

We may confirm limited operational information with the organization that arranged the service, such as whether the arranged vehicle was picked up.

We do not ordinarily provide detailed rental activity unless the customer has authorized it, it is necessary to administer the arrangement, or the law permits or requires it.

4.12 Petitions and advocacy

When a person signs a HeyYa petition or participates in an advocacy campaign, we may collect:

• name;

• email address;

• city;

• province;

• comments; and

• consent or delivery records.

The form will identify the intended recipients and explain how the information and comments may be used or shared.

Depending on the campaign, information may be sent to elected officials, government departments, regulators, municipalities, agencies, or other identified recipients.

4.13 Tours, franchising, investments, employment, and other programs

We may introduce or operate forms and programs involving:

• guided tours;

• corporate rentals;

• franchise applications;

• investor inquiries;

• employment applications;

• gift cards;

• referrals;

• loyalty programs;

• contests;

• surveys;

• reviews;

• testimonials; and

• customer-submitted photographs or social-media content.

We will collect the information reasonably necessary to administer the relevant inquiry, application, transaction, program, or legal relationship.

A franchise, employment, investment, or corporate application may require more detailed professional, financial, business, employment, or background information than a standard customer inquiry.

Information collected through an employment application may be retained for as long as reasonably necessary to:

• assess the application;

• consider the applicant for future roles;

• meet employment-law requirements;

• resolve disputes; or

• protect HeyYa’s legal interests.

We will obtain appropriate permission before publishing an identifiable customer’s photograph, testimonial, review, or submitted content for promotional purposes.

4.14 Social-media information

We may view, collect, or retain information that a person makes publicly available on social-media platforms.

This may include:

• posts that tag or mention HeyYa;

• public comments or reviews;

• photographs or videos involving a HeyYa vehicle;

• public complaints or customer service requests;

• information concerning an accident, damage, unsafe conduct, fraud, theft, or misuse; and

• other publicly available content relevant to our business or services.

We may:

• respond to public comments or customer concerns;

• contact a person about a post involving HeyYa;

• request permission to repost customer content;

• preserve screenshots or other records for an investigation or dispute; and

• use relevant public information to investigate an incident, protect our property, or enforce a rental agreement.

We will obtain permission before using an identifiable customer’s image or comments in our own promotional material, except where another use is permitted by law.

4.15 Accessibility and special requests

Customers may voluntarily provide information concerning accessibility, mobility, disability, health, or other needs when requesting an accommodation or special arrangement.

We do not ordinarily ask for a diagnosis or detailed medical history.

We ask customers to provide only the information needed for us to understand and respond to the request.

This information may be recorded in a reservation note and made available to staff who need it to arrange or provide the service.

5. Why we collect and use personal information

We may collect and use personal information to:

• create and administer reservations;

• confirm a driver’s identity, age, licence status, and eligibility;

• provide vehicles, tours, and other services;

• communicate pickup, access, lockbox, safety, return, extension, and support instructions;

• process payments, deposits, refunds, adjustments, and authorized post-rental charges;

• maintain rental, transaction, and accounting records;

• provide customer support;

• locate, monitor, maintain, charge, repair, and recover vehicles;

• investigate accidents, damage, tickets, theft, loss, fraud, misuse, prohibited conduct, or contract breaches;

• assess and process insurance matters;

• respond to emergencies;

• protect the safety and security of customers, passengers, staff, the public, and property;

• determine whether a person remains eligible to rent from HeyYa;

• maintain internal fraud, safety, non-payment, or do-not-rent records;

• comply with rental agreements and other contracts;

• operate petitions, tours, contests, referrals, loyalty programs, corporate programs, gift cards, franchise programs, and other services;

• respond to inquiries, applications, complaints, disputes, and legal claims;

• collect debts;

• improve our services, website, fleet, pricing, locations, and business operations;

• conduct surveys, analytics, advertising measurement, and business planning;

• prevent and detect fraud, abuse, and cybersecurity incidents;

• supervise and train staff;

• assess service quality and staff performance;

• meet tax, accounting, insurance, legal, regulatory, and reporting requirements;

• evaluate or complete a financing, restructuring, franchise, merger, acquisition, or sale involving part or all of our business; and

• carry out other purposes that we explain when the information is collected or that are permitted or required by law.

We will not use personal information for a materially different purpose unless we obtain additional consent or the use is otherwise permitted by law.

6. Rental eligibility and refusal of service

HeyYa may maintain records concerning a person’s rental history and prior conduct.

These records may include:

• unpaid balances;

• chargebacks;

• disputed transactions;

• damage;

• unsafe driving;

• prohibited use;

• fraud or suspected fraud;

• theft;

• failure to return a vehicle;

• abusive or threatening conduct;

• breaches of a rental agreement;

• internal safety or risk warnings; and

• previous decisions to restrict or refuse service.

HeyYa may decline, restrict, cancel, or place conditions on a present or future rental where we reasonably believe that doing so is necessary to:

• protect safety;

• prevent fraud or non-payment;

• protect our vehicles or other property;

• enforce a rental agreement;

• comply with insurance or legal requirements; or

• manage a legitimate business risk.

Where appropriate and legally permitted, HeyYa personnel may review the relevant circumstances before making or confirming a decision.

7. Consent

We obtain consent where required by law.

Consent may be:

• express, such as when a person signs an agreement, selects a checkbox, submits a form, or gives verbal authorization;

• implied from a person’s actions and the reasonable expectations surrounding a transaction; or

• unnecessary where the law permits or requires collection, use, or disclosure without consent.

By making a reservation or using a HeyYa vehicle, the customer consents to the collection and use of the information reasonably required to:

• provide the rental;

• verify drivers;

• process payments;

• communicate with the customer;

• monitor and recover the vehicle;

• administer the rental agreement; and

• protect HeyYa’s legitimate legal, safety, security, and operational interests.

A person may withdraw consent to certain optional uses by contacting us.

Withdrawal does not operate retroactively and may be subject to legal, contractual, insurance, safety, or operational restrictions.

If a person withdraws consent to a use that is necessary to provide a service, we may be unable to provide or continue that service.

For example, we cannot provide a self-drive rental without obtaining driver-identification, payment, communication, and vehicle-monitoring information.

8. Marketing communications

We may send promotional or marketing emails where we have express consent or where consent may be implied under Canada’s anti-spam legislation.

For example, implied consent may exist for a limited period following a purchase, rental, contract, inquiry, or application.

The applicable period depends on the nature and timing of the relationship.

Transactional and service messages, including booking confirmations, pickup instructions, safety notices, return reminders, receipts, and communications concerning an active rental, are not treated as optional marketing messages merely because they are sent by email.

Marketing emails will identify the sender and include an unsubscribe method as required by law.

A person may unsubscribe at any time by using the unsubscribe link in the message or by contacting admin@heyya.ca.

We may retain limited suppression-list information to ensure that the person’s unsubscribe request continues to be respected.

Unsubscribing from marketing will not prevent us from sending communications necessary to administer:

• a reservation;

• a rental;

• a payment;

• an incident;

• a legal obligation; or

• an existing business relationship.

We do not currently send promotional marketing by text message.

We may use text messaging for operational rental communications and customer support.

9. When we disclose personal information

We may disclose personal information in the following circumstances.

9.1 Service providers

We use service providers to support activities such as:

• website hosting;

• cloud databases and storage;

• identity verification;

• payment processing;

• GPS and telematics;

• email and communications;

• telephone and text messaging;

• workflow automation;

• customer support;

• document and spreadsheet services;

• analytics and advertising;

• accounting;

• information technology;

• security;

• insurance;

• legal services; and

• debt collection.

These providers may process personal information only as needed to perform services for us, subject to their contracts, legal obligations, security measures, and privacy practices.

9.2 Hotels, partners, booking marketplaces, and corporate customers

We may provide limited information to a:

• hotel;

• concierge;

• travel partner;

• booking marketplace;

• event organizer;

• corporate customer; or

• other organization that arranged or paid for a service.

This may include a customer’s first name, expected arrival, pickup status, or other information reasonably required to coordinate the service.

For corporate or event rentals, we may confirm that a vehicle was picked up or that an arranged service was provided.

We will not ordinarily disclose detailed trip, route, or driver information to the paying organization unless:

• the customer has authorized it;

• it is reasonably necessary to administer the arrangement; or

• it is permitted or required by law.

9.3 Roadside assistance, towing, repair, and recovery

We may disclose relevant information to:

• roadside assistance providers;

• towing companies;

• mobile repair providers;

• vehicle recovery contractors;

• repair shops;

• emergency service providers; and

• other contractors helping us respond to an incident.

The information disclosed may include:

• customer name and telephone number;

• vehicle number and licence plate;

• live or recent vehicle location;

• details of the problem or incident;

• pickup or destination information; and

• other information reasonably required to provide assistance or recover the vehicle.

9.4 Insurers, investigators, and professional advisers

We may disclose relevant information to:

• insurers;

• insurance adjusters;

• investigators;

• lawyers;

• accountants;

• auditors;

• repair providers;

• collection agencies; and

• other professional advisers.

We may do so to investigate or resolve:

• an accident;

• an insurance claim;

• damage;

• theft;

• a dispute;

• a chargeback;

• a ticket;

• an unpaid account; or

• another legal or operational matter.

9.5 Police, regulators, courts, and government bodies

We may disclose personal information to police, regulators, courts, tribunals, government bodies, emergency services, or other authorized parties where:

• disclosure is required by law, warrant, subpoena, court order, or legal process;

• we reasonably believe disclosure is necessary to respond to an emergency;

• disclosure is reasonably necessary to investigate or prevent fraud, theft, an accident, unsafe conduct, unlawful activity, or a breach of an agreement;

• disclosure is necessary to recover a vehicle or other property;

• disclosure is needed to establish, exercise, or defend a legal claim; or

• disclosure is otherwise permitted by applicable law.

9.6 Business transactions

Personal information may be reviewed, disclosed, or transferred as part of a proposed or completed:

• financing;

• investment;

• franchise transaction;

• reorganization;

• merger;

• acquisition;

• sale;

• insolvency process; or

• transfer of all or part of HeyYa’s business or assets.

Where applicable, we will use contractual or other measures to limit the handling of personal information to the purposes of evaluating or completing the transaction and continuing the business.

9.7 With consent

We may disclose information for another purpose with the individual’s consent.

10. We do not sell personal information

HeyYa does not sell, rent, or trade personal information to third parties.

We may disclose information to service providers and other parties for the purposes described in this policy.

Those operational disclosures are not sales of personal information.

11. Storage and processing outside Canada

HeyYa uses Canadian and international technology providers.

Personal information may therefore be stored or processed in Canada, the United States, or other countries where our service providers operate.

Information processed outside Canada may be subject to the laws of the foreign jurisdiction and may be accessible to courts, law-enforcement bodies, national-security authorities, or regulators in that jurisdiction.

We select service providers based on operational, technical, security, and commercial considerations and take reasonable steps to protect information entrusted to them.

Contact our Privacy Officer for more information about the processing of personal information outside Canada.

12. Artificial intelligence and automated tools

HeyYa may use artificial intelligence or automated tools to assist with activities such as:

• drafting or summarizing communications;

• transcribing voicemails;

• organizing customer-support requests;

• analyzing operational or booking data;

• detecting fraud or unusual activity;

• identity verification;

• website and software development; and

• improving internal processes.

We do not intentionally enter identifiable customer information into general-purpose public artificial-intelligence services.

Specialized service providers, including identity-verification and communications providers, may use automated systems as part of the services they provide.

We do not rely solely on a general-purpose artificial-intelligence system to make significant legal or service decisions about a customer without appropriate human review.

13. Quality assurance, supervision, and training

HeyYa managers may review customer and staff interactions for:

• customer service;

• quality assurance;

• staff training;

• supervision;

• performance management;

• safety;

• dispute resolution;

• fraud prevention; and

• compliance with company procedures.

The information reviewed may include:

• emails;

• text messages;

• voicemails and voicemail transcripts;

• booking notes;

• customer complaints;

• incident records;

• staff actions;

• system logs;

• rental records; and

• other communications or operational records.

Access to this information is limited to authorized personnel who require it for their work.

14. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate:

• legal;

• insurance;

• accounting;

• security;

• chargeback;

• ticket;

• accident;

• dispute-resolution;

• operational; and

• business-continuity purposes.

Retention periods vary by record type and circumstances.

14.1 Driver’s licence images and identity records

We ordinarily retain copies or photographs of driver’s licences for up to 180 days after collection, unless a longer period is reasonably necessary because of:

• an accident;

• damage;

• a ticket;

• fraud or suspected fraud;

• a chargeback or payment dispute;

• an insurance claim;

• litigation or anticipated litigation;

• a police, regulatory, or legal matter;

• an outstanding balance; or

• another unresolved rental matter.

The identity-verification provider may retain information under its own retention practices and legal obligations.

14.2 Rental and transaction records

Rental agreements, booking records, payment records, customer profiles, communications, incident records, vehicle records, eligibility records, and related information may be retained for an extended period where reasonably required for:

• tax and accounting records;

• insurance;

• tickets;

• accidents;

• claims;

• chargebacks;

• debt collection;

• repeat-customer service;

• safety and fraud prevention;

• do-not-rent decisions;

• legal limitation periods;

• regulatory requirements;

• historical fleet records; or

• the establishment, exercise, or defence of legal rights.

14.3 GPS and telematics records

GPS and telematics information may be retained for:

• fleet history;

• accident investigation;

• insurance;

• vehicle recovery;

• legal disputes;

• fraud prevention;

• operational analysis; and

• safety purposes.

We will periodically review whether identifiable location information remains reasonably necessary and may delete, aggregate, or anonymize it when it is no longer required.

14.4 Communications

Email, text-message, voicemail, support, and customer-service records may be retained as part of the customer’s rental or business history and for:

• operational purposes;

• legal matters;

• security;

• training;

• quality assurance;

• eligibility decisions; and

• dispute resolution.

14.5 Accident, insurance, and claim records

Records relating to accidents, injuries, damage, insurance claims, police matters, litigation, or third-party disputes may be retained for the life of the matter and for an additional period reasonably required for:

• insurance;

• limitation periods;

• legal defence;

• accounting;

• regulatory compliance; or

• future related claims.

14.6 Employment records

Employment and applicant information is retained for as long as reasonably necessary to meet employment, tax, human-rights, workplace-safety, litigation, and other legal requirements.

14.7 Deletion and anonymization

When personal information is no longer reasonably required, we will take reasonable steps to delete, destroy, or anonymize it.

Information may remain for a limited period in system backups, archives, logs, or disaster-recovery systems until those records are overwritten or securely deleted in the ordinary course.

We may retain anonymized or aggregated information that can no longer reasonably identify an individual.

15. Security safeguards

HeyYa uses reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information.

These measures may include:

• individual staff accounts;

• multifactor authentication;

• role-based or location-based access controls;

• access and change logging;

• encryption provided by our technology platforms;

• restricted access to payment information;

• secure cloud services;

• staff policies and training;

• vendor selection and contractual safeguards;

• monitoring and incident investigation; and

• physical and operational controls.

HeyYa staff cannot view a customer’s complete payment-card number or payment-card security code.

No method of transmitting or storing information is completely secure.

We cannot guarantee that a cybersecurity incident, unauthorized access, or accidental disclosure will never occur.

If we become aware of a privacy or security incident, we will:

• investigate it;

• take reasonable steps to contain and address it;

• involve relevant service providers, insurers, legal advisers, or security professionals where appropriate; and

• provide any notification required by applicable law.

The Privacy Officer is responsible for coordinating HeyYa’s response to a privacy incident.

16. Staff access

Authorized staff may access customer, booking, identification, communication, telematics, incident, and operational information where access is reasonably required for their work.

Access may be controlled according to role, responsibility, or operating city.

Staff accounts are assigned individually, and system activity may be logged.

Staff do not have access to complete payment-card credentials.

17. Accuracy

We rely on customers to provide accurate and complete information and to notify us when relevant information changes.

We may ask a person to verify or update their information before providing a rental or responding to a privacy request.

18. Access and correction requests

Subject to applicable law, an individual may ask:

• whether HeyYa holds personal information about them;

• how their information has been used;

• to whom it has been disclosed;

• to access their personal information; or

• to correct information that is inaccurate or incomplete.

Requests should be sent to our Privacy Officer at admin@heyya.ca.

We may require sufficient information to identify the records being requested and verify the requester’s identity.

This may include a copy of government-issued identification, such as a driver’s licence.

When identification is provided solely to verify a privacy request, we will use it for that purpose and handle it securely.

Legal exceptions may prevent us from providing access to some records or information.

For example, access may be restricted where disclosure would reveal:

• another person’s personal information;

• privileged information;

• confidential commercial information;

• security information; or

• information connected to an incomplete investigation.

We will respond within the period required by applicable law.

19. Complaints

Questions or concerns about HeyYa’s handling of personal information should first be directed to our Privacy Officer:

Chief Operating Officer and Privacy Officer
Email: admin@heyya.ca
Telephone: +1-236-624-3992
Mail: 1040 West Pender Street, Box 46, Vancouver, British Columbia V7X 1M3

We will review the concern and respond within a reasonable period.

If a concern is not resolved, the individual may contact the Office of the Information and Privacy Commissioner for British Columbia.

20. Children and passengers

A renter or driver must meet HeyYa’s minimum rental age, which is currently 25 years.

Passengers may be under 25, including children.

We do not intentionally direct our website or rental-booking services to children, and we do not knowingly ask children to submit personal information directly to us.

Where a program, contest, tour, or other service involves information about minors, we will obtain any consent required by law and collect only the information reasonably necessary to provide that service.

21. Third-party websites and services

Our website may contain links to websites or services operated by other organizations.

HeyYa is not responsible for the privacy, security, content, or practices of third-party websites or services.

Individuals should review the applicable privacy policies before submitting information to them.

22. Changes to this policy

We may update this Privacy Policy to reflect changes in our:

• services;

• technology;

• operations;

• providers; or

• legal obligations.

The current version will be posted on our website with its effective date.

Where a change is material, we may provide additional notice through our website, booking process, email, or another appropriate method.

Continued use of our services after an update does not replace any consent required by law.

23. Contact us

Questions, requests, or complaints concerning this Privacy Policy or HeyYa’s privacy practices may be directed to:

Chief Operating Officer and Privacy Officer
HeyYa Carts
1040 West Pender Street, Box 46
Vancouver, British Columbia V7X 1M3
Canada

Email: admin@heyya.ca
Telephone: +1-236-624-3992