EU Data Act Notice

Who You Are Contracting With

OnFire is operated by two companies. Which one you contract with depends on where you are located.

This document is the version that applies where your counterparty is OnFire Messenger Ltd. If your counterparty is OnFire Messenger Inc., the corresponding United States version applies to you instead, and is available in the OnFire Legal Center at https://onfire.so/legal.

If you are located outside both the European Economic Area and the United States, contact [email protected] and we will confirm which terms apply to you before you rely on this document.

Data protection. Where this document concerns personal data, the company named above as your counterparty is the data controller for your personal data. For users in the European Economic Area that is OnFire Messenger Ltd., and the supervisory authority is the Irish Data Protection Commission. For users in the United States that is OnFire Messenger Inc., and the rights set out in the United States Privacy Policy apply instead.

If you move, or deal across regions. The company you contract with is determined by where you are located when you use the Services. If you relocate permanently to the other region, the version applying to that region will govern your use of the Services from that point. Dealing with a user, merchant, courier, driver or host located in the other region — for example, buying from a seller in the United States while you are in the European Economic Area — does not change which company you contract with, and does not affect any mandatory consumer protection you have under the law of your country of residence.

This Information Notice explains how OnFire Messenger Ltd. ("OnFire", "we", "us", "our") complies with the EU Data Act, Regulation (EU) 2023/2854 ("Data Act"), in relation to data generated by connected products and related services, including e-vehicles (e-scooters, e-bikes) and connected devices made available through the OnFire App.

1. About This Notice

The EU Data Act establishes rules on who can access, use, and share data generated by connected products and related services. OnFire acts as a "data holder" within the meaning of the Data Act in respect of certain data generated through the use of connected vehicles and devices available through the OnFire App.

This notice applies to:

• E-scooters and e-bikes available through OnFire's e-vehicle rental service
• Connected devices or equipment that generate data during the provision of OnFire services
• Related digital services that collect and process data from such products

This notice is provided in accordance with Articles 3 and 4 of the Data Act.

2. Types of Data Generated

When you use OnFire's connected products and related services, the following categories of data may be generated:

2.1. Vehicle Telemetry Data

• GPS location and position data during the rental period
• Speed and acceleration data
• Battery level and charge status
• Distance travelled
• Route data (origin to destination path)
• Trip duration

2.2. Ride Summary Data

• Start and end time of each rental
• Start and end location
• Total distance and duration
• Fare and payment information
• Parking location upon trip completion

2.3. Device Diagnostics and Technical Data

• Vehicle hardware status and condition
• Battery health and charging cycle data
• Motor performance data
• Connectivity status (cellular, Bluetooth)
• Firmware version and update status
• Error codes and fault diagnostics
• Sensor readings (accelerometer, gyroscope)

2.4. Safety Data

• Incident detection data (e.g., sudden stops, impacts)
• Riding behaviour indicators (e.g., excessive speed events)
• Geofence compliance (restricted zones, no-ride zones)

3. Data Storage

3.1. Location of Storage

Data generated by connected products is stored on cloud servers located within the European Union. OnFire uses data centres in the EU/EEA for the primary storage of all data generated by connected products.

3.2. Retention Periods

After the applicable retention period, data is securely deleted or irreversibly anonymised.

3.3. Data Formats

Data is stored in structured, machine-readable formats (JSON, CSV) and can be made available in commonly used, machine-readable formats upon request.

4. Data Access Rights

Under the Data Act, users of connected products have the following rights regarding data generated by their use:

4.1. Right to Access Data (Article 4)

You have the right to access the data generated by your use of OnFire's connected products. This includes:

• Access to data in a structured, commonly used, and machine-readable format
• Access provided free of charge, without undue delay, and continuously in real-time where technically feasible
• Access to the same quality of data as is available to OnFire

To request access to your data, please contact [email protected] or use the data export feature in the OnFire App (Settings > Privacy > Download My Data).

4.2. Right to Share Data with Third Parties (Article 5)

You have the right to request that OnFire make your data available to a third party of your choosing. When exercising this right:

• You must provide a clear identification of the third party and the data to be shared
• The third party must agree to process the data only for the purpose you specify
• OnFire will make the data available to the third party without undue delay, free of charge, in a structured, commonly used, and machine-readable format
• OnFire will not use the data shared with a third party to derive insights about the economic situation, assets, or production methods of the user

To request data sharing with a third party, please contact [email protected] with the details of the third party and the specific data you wish to share.

4.3. Right to Request Deletion

Where data is no longer necessary for the purpose for which it was collected, and subject to legal retention requirements, you have the right to request deletion of data generated by your use of connected products.

4.4. Right to Complain

If you believe that OnFire has not complied with your data access rights under the Data Act, you have the right to:

• Submit a complaint to OnFire at [email protected]
• Lodge a complaint with the competent authority in Ireland
• Seek judicial redress through the courts of Ireland or any other competent court

5. Pre-Contractual Information

In accordance with Article 3(2) of the Data Act, OnFire provides the following information before you enter into a contract for the use of connected products:

5.1. Nature and Volume of Data

The types of data generated are set out in Section 2 of this notice. The volume of data generated depends on the duration and nature of your use of the connected product (e.g., longer rides generate more telemetry data).

5.2. Continuous Generation

Vehicle telemetry and diagnostic data are generated continuously during the use of connected products. Ride summary data is generated upon completion of each rental.

5.3. How Data May Be Accessed

Data may be accessed through:

• The OnFire App (trip history, ride summaries)
• Data export request to [email protected] (full data in machine-readable format)
• In-app data download (Settings > Privacy > Download My Data)

5.4. OnFire's Use of Data

OnFire uses the data generated by connected products for:

• Providing and improving the e-vehicle rental service
• Ensuring the safety of users and the public
• Vehicle fleet management, maintenance, and diagnostics
• Billing and payment processing
• Compliance with legal and regulatory obligations
• Generating anonymised and aggregated analytics for service improvement

6. Permissible Use and Sharing

6.1. Your Use of Data

You may use data generated by your use of connected products for any lawful purpose, including:

• Personal record-keeping
• Sharing with insurance providers
• Use with compatible third-party applications and services
• Environmental or health tracking

6.2. Restrictions on Third-Party Use

In accordance with Articles 4(6) and 6(2) of the Data Act, the following restrictions apply to third parties who receive data at your request:

• No competing product development: Third parties must not use the data to develop a competing connected product.
• No profiling: Third parties must not use the data to profile individuals except where strictly necessary for the service requested by the user.
• No onward sharing: Third parties must not make the data available to another third party unless required for the service requested by the user.
• No economic insights: The data must not be used to derive insights about the economic situation, assets, or production methods of the data holder (OnFire) or of any other person.
• No gatekeeper sharing: In accordance with Article 5(3) of the Data Act, data must not be made available to designated gatekeepers under the Digital Markets Act, Regulation (EU) 2022/1925 ("DMA").

6.3. OnFire's Obligations

OnFire will not:

• Use data generated by connected products to derive insights about the economic situation, assets, or production methods of users, except where necessary for the provision of the service
• Make data available to third parties without the user's request or a valid legal basis
• Restrict users' rights to access or share their data except as permitted by the Data Act

6.4. Trade Secrets

Where data requested by a user or third party includes trade secrets within the meaning of Directive (EU) 2016/943, OnFire may apply proportionate technical and organisational measures to preserve the confidentiality of those trade secrets, including:

• Restricting access to specific data fields
• Anonymising or aggregating data where possible
• Entering into confidentiality agreements with the user or third party

Such measures will not undermine the user's right to access and use the data.

7. Dispute Resolution

If you have a dispute with OnFire regarding your rights under the Data Act, the following options are available:

7.1. Internal Resolution

Contact [email protected] to raise your concern. We will deal with it as promptly as we can. We are not currently able to commit to a fixed response time and will not state one until it is a time we can keep.

7.2. Competent Authority

You may lodge a complaint with the competent authority responsible for the application and enforcement of the Data Act in Ireland.

7.3. Judicial Redress

You have the right to seek judicial redress through the courts of Ireland or any other competent court in accordance with applicable procedural rules.

8. Changes to This Notice

OnFire may update this Information Notice from time to time to reflect changes in our services, connected products, or applicable law. Material changes will be communicated through the OnFire App or by email.

9. Contact

For questions about this EU Data Act Information Notice, or to exercise your data access rights, please contact:

OnFire Messenger Ltd. Email: [email protected] Website: https://onfire.so

This EU Data Act Information Notice was last updated on 14 April 2026.