1. Introduction and scope

drovox Technologies, the operator of the drovox application and services, is committed to protecting personal data and processing it in accordance with Saudi Arabia’s Personal Data Protection Law, its regulations and other applicable laws.

This policy refers to that legal entity as “drovox,” “we,” “us” or “the Company.” It is the controller responsible for determining why and how personal data is processed.

This policy explains the passenger data we collect, its sources, processing purposes and legal bases, how it is shared, stored, protected and destroyed, and the rights available to individuals.

It applies to users of the passenger application and associated ride-booking services, including people for whom someone else books a ride. Driver data relating to registration or the provision of transportation services is governed by a separate notice.

Reading this policy or using the application does not, by itself, constitute consent to processing that requires separate consent.

2. Data we collect

We collect data necessary to provide the service and fulfil the purposes described in this policy, depending on how you use the application.

A. Account data

This includes your name and mobile number, email address and profile photograph if provided, and account preferences and settings.

We explain at collection whether information is mandatory or optional. Without mandatory information, we may be unable to provide the associated service. Declining to provide optional information affects the relevant feature only to the extent that it depends on that information.

B. Booking and ride data

This includes pickup and destination locations, ride date and time, service type, assigned driver, booking status, route, duration and distance, fares, fees, discounts, cancellation information, ride history and ratings.

We may associate the ride route recorded from the driver’s device with your account even if you have not permitted location collection from your device, because that route relates to the ride provided to you.

C. Location data

We process the pickup and destination locations you specify when booking. With the appropriate application permission, we may collect your device’s precise or approximate location to help identify your pickup point, provide the ride and operate related features.

The application’s permission request explains the scope of location access. We do not collect your device’s background location without the appropriate permission or use that permission for continuous collection unrelated to the service or feature explained to you.

You can manage location permissions in your device settings. Disabling permission may affect location-dependent features. You can specify your pickup location manually instead of using your device’s location.

D. Payment and transaction data

This includes payment method, transaction amount, status and reference, billing and refund information, and information necessary to verify payments and handle payment disputes.

Electronic payments are processed through payment service providers. The information we receive depends on the payment method and integration used. We do not request payment information beyond what is necessary to execute and verify the transaction and meet legal requirements.

E. Support and communication data

This includes enquiries, complaints, reports, feedback and attachments you submit, support communication records, and information relating to lost property or claims.

If a communication channel involves recording a call, we notify you when recording begins and explain its purpose. Using the application does not authorise access to the content of your personal calls or messages outside communication channels provided by drovox.

F. Device and usage data

This includes technical information necessary to operate, protect and improve the application, such as device type, operating system and version, application version, IP address, login and crash records, and interactions with application features.

G. Data for rides booked by others

If someone books a ride for you, we may receive your name, contact number, pickup and destination locations, and information necessary to provide the ride.

Anyone providing another person’s data should be authorised to do so and should inform that person of this policy. This does not remove the Company’s legal obligations towards that person.

3. Data sources

We obtain data:

• Directly from you when you register, book or contact us.
• Through application use and ride fulfilment.
• From someone booking a ride for you.
• From the driver in relation to the ride or associated reports.
• From payment and technical service providers, within the scope of their services.
• From competent authorities or parties involved in a claim or dispute, where obtaining the data is lawful and necessary.

When we collect your data from someone else, we provide the legally required information within the applicable period unless a legal exception applies.

4. Processing purposes and legal bases

We process data for the following purposes:

Service delivery and performance of an agreement: Creating accounts and verifying mobile numbers, booking rides and assigning drivers, processing payments and refunds, issuing receipts, and handling service enquiries, lost property and complaints.

Legal obligations: Meeting regulatory and tax requirements, responding to lawful requests from competent authorities, and retaining legally required records.

Legitimate interests: Preventing fraud, protecting accounts and systems, diagnosing faults and improving service quality, where necessary and following an assessment that balances these interests against your rights, interests and reasonable expectations. We do not rely on this basis to process sensitive data.

Consent: Direct marketing and optional processing that requires your consent. We explain the purpose before requesting consent. You may withdraw it without affecting processing supported by another legal basis.

Other legally permitted circumstances: Protecting individuals’ lives, health or safety, or handling claims and disputes, where the conditions of the applicable legal basis are satisfied.

We do not use data for purposes incompatible with those for which it was collected. We provide the necessary information and obtain any required consent before additional processing.

5. Sharing and disclosure

We limit sharing to information necessary for the specified purpose, supported by an appropriate legal basis.

A. With the driver

We share information necessary to fulfil the ride, such as your displayed name, pickup and destination locations, rating where displayed, and the communication method needed to coordinate the ride. We do not provide unnecessary payment data or your other ride history.

B. With the person booking or paying for the ride

We may provide booking details, status, receipts and information necessary to manage the booking or payment. This does not grant access to account information or rides unrelated to that booking.

C. At your request

When you use a feature to share ride details, we share the information specified for that feature with the person you choose. Share ride links only with trusted people, as anyone receiving the link may be able to access the information available through it.

D. With service providers

We may share necessary data with providers of hosting, storage, maps, payments, verification messages, support, and technical and security services, according to their functions.

We define their roles and obligations and apply appropriate contractual safeguards where they process data on our behalf. Some providers, such as payment providers, may act as independent controllers for certain purposes under their own privacy notices.

E. For legal requirements and claims

We may disclose specific data to competent authorities, professional advisers, insurers or claims-related parties where disclosure is lawful, necessary and proportionate.

A third-party request or the existence of a dispute does not automatically justify disclosure of all your data.

F. Business transfers

Limited data may be processed during a merger, acquisition, restructuring or business transfer, subject to a legal basis, confidentiality and data minimisation. We provide the necessary notice if the controller or processing practices change.

6. Marketing and tracking technologies

We obtain your consent before processing your data for direct marketing. You can stop marketing messages using the method indicated in the message or by contacting privacy@drovox.com, without charge or impact on the core ride service.

We may continue sending necessary operational messages, such as verification codes, ride updates, receipts and security alerts.

We do not sell your personal data or share it with other parties to market their products directly to you without the required consent.

If cookies, analytics tools or optional tracking technologies are used, we explain their purposes, the data involved, recipients and control options before processing that requires consent. Device permission to receive notifications does not constitute blanket consent to marketing or sharing data with advertising platforms.

7. Messages and device permissions

The application may support automatic verification-code entry through mechanisms available in your operating system. This functionality does not give the Company general permission to read your personal messages.

Device permissions, such as location, camera or photographs, are requested when needed for the relevant feature. You can manage them in device settings, although this may affect that feature.

8. Automated processing

We may use automated processing to assign drivers, manage bookings, calculate fares and fees under applicable pricing mechanisms, and detect indicators of fraud.

We explain fares and fees through the booking process and service terms. If particular processing involves a decision based entirely on automated processing, we provide the information and obtain the consent required by law before applying it.

You can contact support to challenge a fare, cancellation fee or account-related decision and request a review.

9. Storage and processing outside Saudi Arabia

We store data in electronic systems and restrict access according to operational need and lawful purpose.

Using some service providers may involve processing outside Saudi Arabia, including storage or remote access. Where this occurs, we comply with the Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom, identify the applicable basis and safeguards, and conduct risk assessments where required.

You can contact us for information about overseas processing and safeguards relating to your data, subject to legal limitations and third-party rights.

10. Retention and destruction

We do not retain data indefinitely. Retention periods are determined by:

• The processing purpose and continuing need for the data.
• The duration of the service relationship and account requirements.
• Legally required record and invoice retention periods.
• Claims, proceedings or legal obligations requiring retention.
• The need to retain specific fraud-prevention or security records, supported by a legal basis and proportionate assessment.
• The need to demonstrate consent and manage its withdrawal.

We periodically review retention needs. When retention is no longer necessary, we securely destroy the data or anonymise it so that individuals cannot be reidentified.

You can request account deletion or data destruction through privacy@drovox.com. A legal exception may require retaining specific data without retaining other unnecessary information.

Destruction procedures cover copies held by the Company, processors acting on its behalf and backups, in accordance with legal requirements and approved procedures.

11. Security and incidents

We implement appropriate organisational, administrative and technical measures to protect data against unlawful access, use or disclosure, loss or damage, and review them according to risk.

If a personal data breach occurs, we assess it, take containment and remediation measures, and notify the competent authority and affected individuals when the legal notification conditions are met and within the applicable periods.

12. Your rights

Subject to legal conditions and exceptions, you have rights to:

• Be informed about data collection, processing and legal bases.
• Access your personal data.
• Obtain a readable and clear copy.
• Request correction, completion or updating.
• Request destruction of data no longer needed.
• Withdraw consent for consent-based processing.
• Submit a complaint about processing.

Send your request to privacy@drovox.com. Once a dedicated in-app channel becomes available, you may also use it.

We verify your identity proportionately to the request. We act on rights requests without delay and within thirty days. This may be extended by up to thirty additional days in legally permitted circumstances, with advance notice explaining the extension.

If a legal exception prevents us from fulfilling all or part of a request, we explain the reason to the extent legally permitted.

You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels, including the National Data Governance Platform: https://dgp.sdaia.gov.sa/

13. Minors and bookings for others

Eligibility to create an account and use the service is governed by the Passenger Terms of Use and applicable law.

Where the service involves processing data about someone lacking full legal capacity, we handle rights and consent through their legal guardian where required and appropriately verify guardianship.

Booking for another person does not authorise using their data for marketing or unrelated purposes without a separate legal basis.

14. Policy updates

We may update this policy to reflect changes in services, processing or legal requirements and identify the new version’s effective date.

We notify you of material changes through the application or another appropriate channel. Where a change requires new consent, we obtain it before the relevant processing begins.

Continued application use does not automatically constitute consent to new processing requiring separate consent.

15. Contact

Data controller: drovox Technologies
Commercial Registration No.: 7015327989
Address: Al Hamra District, Riyadh 13217, Kingdom of Saudi Arabia
Email: privacy@drovox.com