Privacy Policy
How we collect, use and protect your personal data on the FleetCare website, the renter and technician apps and the company dashboard, and your rights under Saudi Arabia's Personal Data Protection Law (PDPL) and its Implementing Regulation.
Who we are and how to contact us
FleetCare is a technology platform for on-site light maintenance of rental cars (tyres, battery, oil, wash, inspection) that connects rental companies, renters and technicians approved by the platform. "We" means the operator: FleetCare (Legal entity name pending registration), CR: Being issued, Riyadh, Kingdom of Saudi Arabia. We are the "controller" of the data we process to provide the service to you.
| Item | Details |
|---|---|
| Responsible team | Privacy & Data Protection team |
| info@fleetcare.com.sa (put "Privacy" in the subject) | |
| Address | Riyadh, Kingdom of Saudi Arabia — National Address: Being issued |
| Phone | Coming soon |
| Data Protection Officer | Will be appointed and named here where Article 32 of the Implementing Regulation applies; until then, send requests to the email above. |
Scope of this policy
It covers this website, the renter app, the technician app and the rental-company web dashboard. When a rental company uploads its staff or fleet data to its dashboard, we may process that data on its behalf as a "processor" under a data processing agreement, and the company is responsible for informing its staff.
It does not cover third-party websites or services we may link to; each has its own policy.
Personal data we collect
| Category | Examples | Required? |
|---|---|---|
| Account data | Name, mobile number, email (optional), language, one-time passcode (OTP) | Yes, to create an account |
| Vehicle and order data | Car QR code, model, plate number as registered by the company, service type, time, notes, rating | Yes, to fulfil the order |
| Location data | The car location you set; the technician's location only during an active order to show arrival and ETA | Yes, during the order |
| Proof photos | Before/after photos of the car taken by the technician (we do not ask for photos of people) | Yes, as proof of service |
| Technician data | National ID/Iqama, driving licence and validity dates, qualifications, bank details for payouts | Yes, to approve a technician |
| Payment data | Amount, status, card brand and last four digits, saved-card token held by the payment provider. We never store the full card number or CVV | Yes, when paying |
| Communications and support | Content of messages, complaints and attachments | When you contact us |
| Technical data | Device type and OS, app version, error logs, IP address for security | Automatically |
We do not collect or ask for sensitive data (such as health or beliefs). Technician identity documents are processed only as needed for verification.
How and why we collect data (purposes and legal basis)
We collect data directly from you through forms and fields in the apps and dashboard, automatically from your device while you use them, from the rental company (fleet data and staff permissions) and from the payment provider (transaction result).
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and verifying sign-in | Account data | Performance of an agreement you are party to |
| Receiving the order, offering it to the nearest registered technician and confirming arrival with a PIN | Vehicle, order, location | Performance of the agreement |
| Documenting the service with photos and showing it to the rental company | Proof photos, order data | Performance of the agreement and the rental company's legitimate interest in overseeing its fleet |
| Verifying technicians' documents and their validity | Technician data | Performance of the agreement and legitimate interest in service safety |
| Payments, refunds and e-invoices | Payment and order data | Performance of the agreement and legal obligation (invoicing and VAT) |
| Support and complaints | Communications | Performance of the agreement and legal obligation |
| Security, fraud prevention and bug fixing | Technical data | Legitimate interest (after a documented assessment) |
| Marketing messages | Name, mobile, email | Your consent only — withdraw it at any time |
| Usage analytics and personalisation | Aggregated technical data | Your consent only (asked separately in the app) |
Consent to marketing or analytics is never a condition of the service, and we collect the minimum needed for each purpose.
How we use data
- The system automatically selects the nearest registered technicians whose documents are accepted to offer an order to; this has no legal effect on you, and you can contact us to review any assignment.
- The technician sees only your first name, the car location and order details during the order, and sees your full number only when contact is needed to complete the service.
- The rental company sees orders for its cars, their status, photos and reports.
- We do not sell your data or disclose it to anyone for direct marketing.
Storage and transfers outside Saudi Arabia
We store and process your data on servers inside the Kingdom of Saudi Arabia. We transfer or disclose personal data outside the Kingdom only in accordance with Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom: to a country whose protection the competent authority has found adequate, or with appropriate safeguards (standard contractual clauses, binding common rules or an accreditation certificate), with a risk assessment where required and limited to the minimum data. You can ask us about the safeguards applied.
Retention and destruction
| Data | Retention |
|---|---|
| Account data | While the account is active, then destroyed or anonymised within 90 days of closure unless retention is legally required |
| Technician location tracking | During the active order; the order route is kept 90 days for complaints, then deleted |
| Proof photos and order history | 24 months after completion as proof of service and warranty, unless a shorter period is agreed with the rental company |
| Invoices and financial records | Statutory periods for accounting and tax records (ten years for commercial books; at least six years for VAT records) |
| Technician documents | For the duration of the relationship plus two years, unless the law requires longer |
| Support messages and complaints | Two years after the case is closed |
| Technical and security logs | Up to 90 days |
At the end of the period we destroy data so it cannot be recovered, or anonymise it so the person cannot be identified.
How we protect your data
- Encrypted connections between the apps and servers (TLS 1.2 or later) and certificates on every domain.
- One-time-passcode sign-in, role-based access (renter, technician, company, admin) and least privilege.
- We do not store card numbers; tokens are held by the licensed payment provider.
- Daily backups inside Saudi Arabia, monitoring and regular security updates.
No system is perfectly secure, but we review our measures in line with the sensitivity and volume of the data.
Data breaches
If a breach or unlawful access may harm your data or conflict with your rights, we notify the Saudi Data & AI Authority (SDAIA) within 72 hours of becoming aware of it, and notify you without undue delay in plain language, describing the incident, the risks, the measures taken and what you can do to protect yourself.
Your rights and how to exercise them
- Right to be informed about how your data is collected, its legal basis, purpose and recipients (this policy).
- Right of access and to obtain a copy in a clear, readable format (in the app: Settings → Privacy → Export my data).
- Right to request correction, completion or updating of your data.
- Right to request destruction of your data when it is no longer needed (Settings → Privacy → Delete my account), subject to what the law requires us to keep.
- Right to withdraw consent at any time (marketing, analytics and personalisation in the consent settings), without affecting processing before withdrawal.
- Right to complain to the competent authority and to claim compensation for damage under the law.
We respond within 30 days of receiving your request and verifying your identity; this may be extended by another 30 days with advance notice and reasons. Requests are free of charge.
Complaints and objections
For any complaint or objection about the processing of your data, email info@fleetcare.com.sa; we reply within 15 business days. If you are not satisfied or we do not reply in time, you can complain to the Saudi Data & AI Authority (SDAIA) through the National Data Governance Platform dgp.sdaia.gov.sa, within the periods and procedures SDAIA sets.
Children
The service is for people aged 18 or over. We do not knowingly collect data from anyone younger, and we delete it if we learn of it.
Marketing
We send promotional messages only with your consent; each message identifies us and offers an easy, free way to stop, and we stop as soon as you ask.
This website and cookies
This website uses no cookies and no analytics or advertising tools, and its forms do not currently send data. See the Cookie Notice for details.
Updates and change log
We review this policy periodically. For material changes we notify you in the app or by email before they take effect, and record them below.
| Version | Date | Change |
|---|---|---|
| 1.0 | 10 November 2026 | First version (pre-launch) |