Privacy Notice

1. Who we are

drivoo is operated by TechSphere Solutions Ltd, IH01, Innovations One, DIFC, Dubai, United Arab Emirates. We decide how your personal data is used and are responsible for it. Because we are licensed in the Dubai International Financial Centre (DIFC), the DIFC Data Protection Law (DIFC Law No. 5 of 2020) governs how we use your personal data, and we are its controller under that law.

For questions or requests about your data, contact hello@drivoo.io.

2. Who this notice covers

Riders; guests booked by a hotel or company partner or by our team; people who use a company's drivoo business account; visitors to drivoo.io; chauffeurs (section 12); and people who use our partner and fleet portals.

3. What we collect

• Account: your name, mobile number, email, language, and when you verified them.
• Bookings and trips: pickup, drop-off and stops, times, flight number, passengers and luggage, notes for the chauffeur, the class, the chauffeur and car, the distance driven, status changes, cancellation and no-show reasons, and ratings and comments.
• Location: the rider app uses your phone's location only while it is open, to find your pickup point, and we don't store it. We store the chauffeur's route during each trip.
• Payments: payment references, the type, last 4 digits and expiry of your card, amounts, receipts, refunds and balances. Card numbers go straight to our payment provider, Stripe, and never reach our servers.
• Messages and support: chat with your chauffeur, support requests and the photos you add, and the messages we send you.
• Sign-in and devices: sign-in codes and links, a record of each sign-in with its IP address and device, sessions with the IP address and device name, and the token that lets us send push notifications to your phone.
• Business accounts: company details and documents (trade licence, VAT certificate, the authorised person's Emirates ID and passport), employees' names, mobile numbers, emails, departments and budgets, and business rides and booking reasons.
• Website: what you send us in a form, and what our Cookie Notice describes.
• Consent records: which version of our terms and notices you accepted, when and where, and your marketing choice.

4. Why we use it

Under the DIFC Data Protection Law, these grounds mean: for the service, performing our contract with you (or, when a partner or company booked your ride, our legitimate interest in carrying out that booking); for tax law and our legal duties, a legal obligation; for safety, our legitimate interests in keeping people and accounts safe and preventing fraud, weighed against your rights, or someone's vital interests in an emergency; for marketing, your consent, which you can withdraw at any time.

5. Who sees it

• Your chauffeur and their fleet: what they need for your ride. A fleet sees a partner guest's name only, never the guest's phone or email. A chauffeur can call a guest who doesn't use the app only while the ride is active.
• The partner who booked for you, and a referral partner whose link or code you used: the full details of those rides, including addresses, notes and ratings.
• Your company, for your business rides only. It never sees your personal rides.
• Our service providers, listed on our sub-processor page, who process data for us under contract.
• Authorities, when the law requires it. This can include the police, the courts, transport authorities such as the RTA, and tax authorities. We share only what a lawful request or a legal duty covers and, where the law allows, we tell you.

We don't sell your personal data.

6. Data outside the UAE

Some of our providers process data outside the UAE, for example for payments, messages, maps and error reports. Our sub-processor page lists each one and where it processes data. The DIFC Data Protection Law treats sending data outside the DIFC, even elsewhere in the UAE, as a transfer. We transfer data only to a place the DIFC Commissioner of Data Protection recognises as giving adequate protection, or with appropriate safeguards, such as standard contractual clauses in our contract with the provider. Our servers and database are hosted on Microsoft Azure, UAE North region (Dubai, United Arab Emirates).

7. How long we keep it

• Your account data: while you have the account, then as section 9 explains.
• The chauffeur's route of a trip: the period in our settings after the trip, then it is deleted.
• Receipts, invoices, credit notes and the booking records behind them: 5 years from the end of the tax period they belong to, or longer where UAE tax law requires it.
• Chauffeur records: up to 3 years from the chauffeur's last trip or the account's closure.
• A business account's company documents: 5 years after the account closes.
• The record of each sign-in, with its IP address and device: 5 years from the end of the tax year of the sign-in, as part of the audit record we keep of every change.
• Sign-in sessions, messages we sent, chat, support requests and website forms: 90 days after the session ends, the message is sent, the ride ends, or the request or form is closed, then they are deleted; until then you can ask us for a copy at hello@drivoo.io.
• Our backups are encrypted and kept for a limited time (hourly backups are kept for 7 days and daily backups for 30 days), so erased data can stay in a backup until it expires.

8. Your rights

• Access and a copy: ask for a copy of your data, as a readable PDF or as a JSON file other services can read. Where your app offers "Download my data", you can get it there straight away.
• Correction: change your name and email in the app, and ask us to correct anything else.
• Deletion: delete your account in the app (section 9).
• Restriction and objection: ask us to limit or stop using your data for a purpose. We tell you if the law, or a ride still under way, means we can't.
• Marketing: you can say no to marketing at any time. Messages about your rides, payments, account and security still come.
• Withdrawing consent: where we rely on your consent, you can withdraw it at any time.
• Complaints: you can complain to the DIFC Commissioner of Data Protection.

We answer a request within one month and may ask you to show it is you.

9. Deleting your account

When you delete your account in the app, it takes effect at once: you are signed out on every device and the account can no longer book. You can't delete it while a ride is still booked or under way.

Your personal details (name, mobile number, email, saved places, preferences and saved cards) are erased once nothing from your trips is still pending, such as a toll or parking charge under review, a balance you owe or an open support request, and a short period after your last trip, so a late toll or parking charge can still be settled with your card. Until then you can sign in only to pay a balance or to keep your account. A balance still unpaid a set period after you asked is written off.

The records of your rides and payments, including pickup and drop-off addresses, are kept for the tax period in section 7, linked to the erased account.

10. Location

The rider app asks for your location only while it is open, to show nearby cars and set your pickup point, and never in the background. The chauffeur app shares the chauffeur's location, in the background too, while they are online, so we can offer rides, follow the trip and detect tolls.

11. Messages and marketing

We send you messages about your rides, payments, account and security by push notification, text message and email, and by WhatsApp once we switch it on. They are part of the service. We don't send marketing today; if we do, it will be only with your agreement, and you can change your mind at any time.

12. If you drive with drivoo

We hold your identity and contact details, your fleet, your documents and their checks (licence, Emirates ID, visa and permits), your approved photo, your shifts and hours online, your location while online, your trips, ratings and cancellation points, the cash you collect and deposit, and your earnings. Your fleet sees what it needs to manage your work. Riders see your approved photo, your name and the car on a live trip. Your records are kept for up to 3 years from your last trip or your account's closure. The chauffeur app has its own privacy notice for chauffeurs, with the full details, and you can read it there at any time.

13. Keeping your data safe

We protect your data with encrypted connections, access limited by role, an append-only record of every change, strong password protection for staff, private storage for documents and encrypted backups. Card numbers are held only by Stripe. If a breach puts your data at risk, we tell you and the regulator as the law requires. We tell the DIFC Commissioner of Data Protection as soon as we practicably can. If the breach is likely to put you at high risk, we tell you without undue delay what happened, what it may mean for you and what you can do to protect yourself.

14. Decisions our system makes

Some decisions are made by our system: the price of a ride, including time of day and demand multipliers; which chauffeur is offered your ride; and refusing a new booking while a balance is unpaid. If you think one was wrong, raise a support request and a person on our team will look at it.

15. Age

An account is for people aged 18 and over.

16. Changes to this document

The version and date at the top show which text is in force. When we change it in a way that matters, we tell you and ask you to accept it again in the app or on the website before your next booking.

17. Contact us

Raise a support request in the app, or contact us at hello@drivoo.io or +971 52 111 0154.