PRIVACY POLICY — LPG GO DEVELOPMENT DRAFT. Not yet final. Items marked [[PENDING]] are pending. Effective Date: 16 September 2026 Last Updated: 16 September 2026 1. WHO WE ARE The LPG Go platform connects customers with accredited LPG dealers and riders for the delivery of liquefied petroleum gas (LPG) cylinders and related products. It is operated by Advanced Market Solutions & Technologies Corporation ("LPG Go", "we", "us", "our"). The personal information controller for this platform is: Advanced Market Solutions & Technologies Corporation (SEC Reg. No. 2026080264116-03) National Highway, San Luis Gallera Compound, San Luis, Taft, Eastern Samar, Region VIII (Eastern Visayas), 6816 Email: support@lpggodelivery.com Contact number: 09156062429 Data Protection Officer: [[PENDING]] 2. SCOPE This Policy explains how we collect, use, share, retain, and protect personal information when you use the LPG Go Customer mobile application, the LPG Go Provider mobile application used by dealers and riders, and any related websites, support channels, and services we operate. By creating an account or using the apps, you acknowledge that you have read and understood this Policy. 3. INFORMATION WE COLLECT 3.1 Information you give us Account details — mobile number, name, profile photo. Applies to customers, dealers, and riders. Delivery details — delivery address, delivery coordinates, landmarks, and delivery notes. Applies to customers. Order details — products ordered, quantity, brand and size, price, and payment method. Messages — chat messages exchanged between a customer and the assigned provider for an order. Reviews and ratings — star ratings, written feedback, and delivery-speed ratings. Verification documents — Mayor's Permit for dealers, Driver's License for riders, and any other document we require for accreditation. Support correspondence — messages you send to our support channels. 3.2 Information collected automatically Location data. With your permission, we collect device location to show nearby providers, to compute delivery routes and estimated times, and, for riders on an active delivery, to display live delivery progress to the customer and to our administrators. Rider location is collected while a delivery is in progress. Device and app data. Device model, operating system version, app version, and a push notification token used to deliver order updates. Usage data. Order history, in-app activity, timestamps, and error or diagnostic logs. 3.3 Information from third parties Payment processor. When you pay electronically, PayMongo processes your payment and returns a confirmation and limited transaction details to us. We do not collect or store your full card number, CVV, or e-wallet credentials. Verification and messaging providers. Providers used for one-time password delivery and account verification. 3.4 Sensitive personal information Government-issued identification documents submitted by dealers and riders for accreditation are sensitive personal information under the Data Privacy Act of 2012 (RA 10173). We collect these only for verification and accreditation. 3.5 Children LPG Go is not directed at, and may not be used by, individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected such information, we will delete it. 4. HOW WE USE YOUR INFORMATION We use personal information to create and maintain your account and verify your identity; to receive, broadcast, assign, and fulfil orders; to show you nearby providers and calculate delivery routes, fees, and estimated arrival times; to enable communication between you and the provider handling your order; to process payments, provider credits, admin fees, and refunds; to send you transactional notifications about your orders and account; to operate loyalty, discount, and promotional programs you take part in; to verify and accredit dealers and riders and log rider safety checks; to investigate disputes, complaints, fraud, misuse, and safety incidents; to maintain records required for accounting, tax, and regulatory purposes; to improve the reliability, security, and performance of the platform; and to comply with law and respond to lawful requests from authorities. We do not sell your personal information. 5. LEGAL BASES FOR PROCESSING We process personal information under one or more of the bases recognized in the Data Privacy Act of 2012: Contract — processing necessary to fulfil the service you requested, for example delivering your order. Consent — where you have given consent, for example for location access, push notifications, or optional marketing communications. You may withdraw consent at any time, subject to Section 9. Legal obligation — where processing is required by law, including tax, accounting, and regulatory record-keeping. Legitimate interests — for fraud prevention, platform security, dispute resolution, and service improvement, where such interests are not overridden by your fundamental rights. For sensitive personal information, we rely on your consent and on the grounds permitted under Section 13 of RA 10173. 6. HOW WE SHARE INFORMATION With providers fulfilling your order. When you place an order, the assigned dealer and rider receive your name, contact number, delivery address and coordinates, and order details, so that the delivery can be completed. Riders see this information only for orders assigned to them. With customers, about providers. Customers see the assigned provider's business or rider name, contact number, rating, and, during an active delivery, the rider's live location. With service providers. We use third parties to host our systems, process payments, deliver notifications, and provide mapping and routing. These parties process data on our instructions and are bound by confidentiality and data protection obligations. Our principal service providers are: Cloud hosting and database — Supabase Payment processing — PayMongo Maps and routing — Google Maps Platform Push notifications — Expo SMS and one-time password delivery — Semaphore With authorities. Where required by law, regulation, court order, or a lawful request from a government or regulatory body, including in connection with safety incidents involving LPG products. In a business transfer. If the business is sold, merged, or reorganized, personal information may be transferred as part of that transaction, subject to this Policy. 7. CROSS-BORDER TRANSFERS Some of our service providers store or process data outside the Philippines. Where this occurs, we take reasonable steps to ensure that a comparable level of protection applies, consistent with the Data Privacy Act of 2012 and its implementing rules. 8. RETENTION We keep personal information only as long as necessary for the purposes described in this Policy, or as required by law. Account profile — name, photo, addresses, contact number: deleted or anonymized within 30 days of account deletion. Basis: proportionality, consistent with the National Privacy Commission's directive in In re Grab Philippines to delete personal data of deactivated accounts within three months. Authentication credentials: deleted immediately on account deletion. No purpose survives the account. Order, payment, and payout records: 10 years, in anonymized form. Basis: BIR Revenue Regulations No. 17-2013, as amended by RR No. 5-2014, on preservation of books of accounts and accounting records. Provider accreditation documents: 5 years after accreditation ends. Basis: prescription of quasi-delict claims, with margin. Chat messages: 90 days after the related order is completed. Basis: dispute-resolution window. Location data from deliveries: 90 days. Operational and dispute purposes only. Support correspondence: 2 years. Complaint handling and dispute history. Security and audit logs: 12 months. Security monitoring and incident investigation. Reviews and ratings: retained indefinitely in anonymized form, as they no longer identify a data subject. Order and payout records cannot be deleted immediately on request, because they are required for tax, accounting, and dispute purposes. Where records must be retained, we anonymize them so they are no longer linked to an identifiable person. Once a retention period expires, data is disposed of securely so that it cannot subsequently be accessed, processed, or disclosed. 9. YOUR RIGHTS Under the Data Privacy Act of 2012, you have the right to be informed about how your personal information is processed; to access the personal information we hold about you; to object to processing, including withdrawing consent; to rectify inaccurate or incomplete information; to erasure or blocking of information in the circumstances allowed by law; to damages for violations of your rights; to data portability where applicable; and to lodge a complaint with the National Privacy Commission. To exercise any of these rights, contact us at support@lpggodelivery.com. We will respond within 15 working days of receiving a verified request. You may also complain to the National Privacy Commission at https://www.privacy.gov.ph. 10. DELETING YOUR ACCOUNT You can delete your LPG Go account at any time: In the app — Profile, then Delete Account. On the web — https://lpggodelivery.com/delete-account When you delete your account, your profile information (name, contact number, address, and profile photo) is permanently removed or anonymized; you will no longer be able to sign in, and your loyalty status and any unredeemed promotional benefits are forfeited; your order and payment records are retained in anonymized form for 10 years, as stated in Section 8, because they are required for accounting, tax, and dispute-resolution purposes; and reviews you have left may remain visible in anonymized form. Deletion is permanent and cannot be undone. If you have an order in progress, you must complete or cancel it before deleting your account. 11. SECURITY We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, row-level database security, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected individuals as required by law. 12. PERMISSIONS THE APP REQUESTS Location — to show nearby providers, set your delivery point, and route and track deliveries. Required for core function. Notifications — for order status updates and chat messages. Optional but recommended. Camera and photos — for your profile photo, and for provider verification documents. Optional for customers, required for providers. You can change these permissions in your device settings at any time. Turning off location will prevent core parts of the service from working. 13. CHANGES TO THIS POLICY We may update this Policy from time to time. If we make material changes, we will notify you in the app or by other reasonable means before the changes take effect. The Last Updated date above shows when this Policy was last revised. 14. CONTACT US Questions, requests, or complaints about this Policy or your personal information: Advanced Market Solutions & Technologies Corporation (SEC Reg. No. 2026080264116-03) Email: support@lpggodelivery.com Phone: 09156062429 Address: National Highway, San Luis Gallera Compound, San Luis, Taft, Eastern Samar, Region VIII (Eastern Visayas), 6816 Data Protection Officer: [[PENDING]]