Privacy Notice

Privacy Policy of Law Enforcement Response System (“LERS”)

This Privacy Notice describes how Grab collects, uses, processes, and disclose Personal Data through use of the Law Enforcement Response System which can be accessed here.

“Personal Data” is any information that can be used to identify users or from which users are identifiable. This includes but is not limited to users name, nationality, telephone number, bank, and credit card details, personal interests, email address, users image, government-issued identification numbers, biometric data, race, date of birth, marital status, religion, health information, vehicle, and insurance information, employment information and financial information.

This Notice applies to law enforcement which requests electronic data and/or information disclosure of Grab users, drivers, merchants, contractors, and service providers.

Grab Commitment in Personal Data Protection

Grab is committed to support the criminal law enforcement procedure in accordance with Law Number 19 Year 2016 Concerning the Amendment of Law Number 11 Year 2008 Concerning Electronic Information and Transactions (“ITE Law”). Grab supports the investigation process from the authorized law enforcement according to Article 43 of the ITE Law. Grab gives access towards its electronic data and/or electronic information taking into account the protection towards privacy, secrecy, and integrity of the data.

Grab refers to Law Number 27 Year 2022 Concerning Personal Data Protection (“PDP Law”) which defines Personal data as data about individuals who are identified or can be identified separately or in combination with other information either directly or indirectly through electronic or non-electronic systems.

Grab also defines the law enforcement personal data as the data submitted through the LERS Portal which includes:

• personal information concerning requester (such as Full name, National Identification Number, Mobile Number, Office Landline Number, and Institutional email);
• official information (such as country, province, city, agency, department, staff number);
• official documents (such as a letter of assignment, court warrant, and other related investigation documents submitted); and
• longitude and latitude coordinate upon the driver and user’s trips.

Personal Data that is available for a request of disclosure

Grab collects Personal Data of its users which are listed above and may also combine the collected Personal Data with other Personal Data in Grab’s possession. Grab only collects Personal Data that is voluntarily provided to Grab, these include electronic data during the following processes:

• complete a user profile or registration form (such as name, contact information, and other identification information where needed);
• provide information to assess user eligibility to provide services as a Grab driver-partner or delivery partner (such as driver’s license information, vehicle information, and background check results (as legally permissible));

Grab also collects Personal Data through the operation of Grab Apps, Websites, and Services which are including but not limited to:

• user’s location (to detect pick-up locations and abnormal route variations);
• transaction information (such as payment method and distance traveled);
• information about how users interacted with Grab Apps, Website or Services (such as features used and content viewed);
• device information (such as hardware model and serial number, IP address, file names and versions, and advertising identifiers or any information that may provide an indication of device or app modification);    
• Personal Data user enter in messages when user use Grab in-app communication features; and
• Personal Data that may be captured through the user’s interaction with the driver, agents, in-vehicle audio, and/or video recording during a ride (such as image and/or voice, and its related metadata).

Personal Data about driver-partners

Grab also collects Personal Data from driver-partners which are including but not limited to:

• telematics data (such as driver’s speed, acceleration, and braking data);
• device data (such as accelerometer data, GPS location, driver’s IMEI number, and the names of apps drivers have installed on the user’s device);    
• driver’s vehicle registration data; 
• personal data that may be captured through interaction which are recorded in the form of audio and/or video recording during a ride (such as driver image and/or voice, and its related metadata); and
• in-vehicle recording, which includes audio/video recording that is captured through personal in-vehicle devices that are installed in driver-owned vehicles for their own safety and security purposes. Grab however does not own this data as it is processed by the relevant drivers. 

Sensitive Personal Data

Grab also collects sensitive personal data which include race, national identification information, religious beliefs, background information (including financial and criminal records, where legally permissible), health data, disability, marital status, and biometric data, as applicable. Grab collects this information based on the data owner’s consent and/or in strict compliance with personal data protection principles which are entailed in PDP Law.

Grab’s Purpose of Collection of Law Enforcement Personal Data in LERS

Grab will only collect personal data from law enforcement through the LERS Portal, all communications and documents collected from law enforcement will only be given to Grab through the LERS Portal. Grab also collects personal data and electronic documents from Law Enforcement under the law enforcement consent which is required during the account creation process of LERS. 

Grab collects Law Enforcement Personal Data for the purpose of user authentication and verification. Grab will not share the law enforcement personal data to other parties except for legal purposes and be treated with personal data protection principles as mentioned under PDP Law.

Law enforcement personal data are then used for the following purposes:

• verification and authentication process;

• verify law enforcement official purposes;
• conduct due diligence checks and risk assessments/analysis;
• enable communications between Grab’s users; 
• assess the legitimacy of personal data requests; and
• other related purposes that are in accordance with the prevailing laws and regulations.  

Protection of Personal Data 

Grab will take reasonable legal, organizational, and technical measures to ensure that the Law  Enforcement Personal Data is protected. This includes measures to prevent Personal Data from getting lost, used, or accessed in an unauthorized way. Grab limits access to Law Enforcement Personal Data to Grab’s employees on a need-to-know basis. Those processing Law Enforcement Personal Data will only do so in an authorized manner and are required to treat the information with confidentiality. 

Legal purposes

Grab may use the obtained Personal Data to investigate and resolve claims or disputes, or as allowed or required by applicable law. Grab may also use Personal Data without consent, by relying on Legitimate Interests or other exemptions provided by the applicable data privacy laws, for purposes such as detection and prevention of fraud. 

Grab may also use users' Personal Data when Grab is required, advised, recommended, expected, or requested from LERS Portal to do so by law enforcement or governmental authority. 

For example, Grab may use Law Enforcement Personal Data submitted to LERS Portal for the following purposes:

• comply with court orders or other legal, governmental, or regulatory requirements;
• enforce Terms of Service or other agreements; and
• protect Grab’s rights or property in the event of a claim or dispute.

Grab may share users Personal Data with the following parties:

Through LERS Portal, law enforcement and governmental authority are able to request specific information from Grab database for legal purposes, such as a criminal case investigation and conduct of a trial. The requested parties will identify the specific account(s) implicated by the lawful request proven by an official letter from the authorized official. 

Grab is also able to identify accounts that are relevant to a law enforcement investigation by searching for information related to a specific trip. In that case, information that can identify the trip should be provided, such as date, time, trip identification, pick up or drop off location, and/or other relevant information. 

Data Sharing with Grab legal advisors and governmental authorities

Grab may share law enforcement Personal Data with Grab’s legal advisors, law enforcement officials, government authorities, and other third parties. This may take place to fulfill the legal purposes (mentioned above), or any of the following circumstances:

1. where it is necessary to respond to an emergency that threatens the life, health, or safety of a person; or 
2. where it is necessary for the public interest (e.g. in a public health crisis, for contact tracing purposes and safeguarding the community). 

Retention Period of Personal Data 

Electronic Data and/or Electronic Information of Grab users obtained from LERS would be provided with encrypted links, which cannot be downloaded and only able to be accessed within a specific period by the requested parties. In addition, for some cases, there will be a 3-months retention period from LERS which is stipulated in the agreement between Grab’s and the Law Enforcement or Government Authorities before receiving the documents. 

Personal data of Law Enforcement or Government Authorities obtained from LERS Portal will be retained for the period necessary to fulfill the purposes outlined in this notice unless a longer retention period is required or allowed by the prevailing laws and regulations. Once Law Enforcement Personal Data is no longer necessary for the Services or Purposes, or Grab and the law enforcement no longer has a legal or business purpose for retaining the Personal Data, we take steps to erase, destroy, anonymize or prevent access or use of such Personal Data for any purpose other than compliance with this Notice, or for purposes of safety, security, fraud prevention, and detection, in accordance with the requirements of applicable laws.

Amendments and Update

Grab may modify, update or amend the terms in this Notice at any time. Such amendments shall be notified through the Application and/ or other appropriate means at least five (5) business days before the effective date. The updated version will be posted on the LERS website. It is law enforcement’s responsibility to review the Privacy Notice regularly. The use of LERS Portal following the modifications, updates, or amendments to this Notice, whether or not getting reviewed, shall constitute the reader’s agreement to be bound by such amendments.

Choice Of Language 

The original of this Notice is prepared simultaneously in English and Indonesian. In the event of any conflict arises due to the difference of interpretation, the meanings of all terms and provisions shall be referred to the Indonesian version.

How to Contact Grab

If you have any inquiries about this Privacy Policy or would like to exercise your rights set out in this Notice, please contact Grab’s Data Privacy Officer at:

 (xxxxxx) TBC