Amendment No. 3 to Google Maps for Work Master Agreement, by and between the Registrant and Google LLC, dated November 18, 2019

This Amendment 3 (The “Amendment”), dated as of the Amendment Effective Date (as defined below), amends the Google Maps For Work Agreement (“Agreement”) entered into between Google LLC. (“Google”) and Uber Technologies Inc. (“Customer”) on October 29, 2015, and as amended from time to time. All capitalized terms used in this Amendment 3 but not defined below will have the meanings given to them in the Agreement.

(1) End User Privacy. Customer will obtain and maintain all required consents from End Users In connection with the Customer Implementation, in accordance with applicable data protection law.

(2) No Personally Identifiable Information. Customer will not provide to Google any End User’s personally identifiable information or device identifiers; Google will not (i) otherwise obtain or infer any personally identifiable information or device identifiers from Customer or End Users (or their devices) in connection with this Agreement, including Service Addendum A, Section 4.3 (Data Reporting), or (ii) attempt to associate trip origins with trip destinations, except that for either (i) or (ii), Google may use anonymized, randomized, temporary (not more than seven days) identifiers (for example, the Google Location Services identifier) solely to prevent abuse such as spamming and scraping by the same device and to collect anonymous, aggregate information as part of Google’s standard practices in compliance with applicable law.

(3) No Personal Data. Neither Party will disclose Personal Data to the other Party in the provision and use of the Services. If either Party determines that the Services require the disclosure of Personal Data, the Parties agree to meet within 30 days of such determination to discuss in good faith measures to comply with applicable data protection law. Personal Data has the meaning provided in the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016).

(4) Cookies. As noted in the Service Documentation, certain Services store and access cookies and other information on End Users’ devices. If Customer uses any of these cookie-enabled Services in the Customer Implementation, then for End Users in the European Union, Customer must comply with the EU End User Consent Policy at http://www.google.com/about/company/user-consent-policy.html.

(1) End User Notification. Customer will ensure that the Customer Implementation(s) notify End Users in advance of the type(s) of data that Customer intends to collect from the End Users or the End Users’ devices. If Customer intends to obtain the End User’s location and use it with any other data provider’s data, Customer must disclose this fact to the End User.

(2) End User Consent. Customer will ensure that the Customer Implementation(s) (a) do not obtain or cache any End User’s location in any manner except with the End User’s prior consent; and (b) will let the End User revoke that consent at any time.

(3) No Geolocation Data that identifies individual End Users. If the Customer Implementation(s) provide Google with geolocation data, the Customer Data must not also include unique device identifiers associated with individual End Users.

(C) European Data Protection Terms. Google and Customer agree to the Google Maps Controller-

Controller Data Protection Terms at https://privacy.google.com/businesses/mapscontrollerterms/.” except that Section 9.2(c) of such terms shall not apply.

All other terms and conditions of the Master Terms will remain unchanged and in full force and effect. To the extent the Master Terms conflict with this Addendum, this Addendum will govern.

Signed by the parties’ authorized representatives on the dates written below.