Privacy Policy — United Arab Emirates

This policy informs you how personal data is processed on the Emaride platform in the United Arab Emirates (www.emaride.ae and the Emaride app for the UAE market). It is information under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"). It is not a consent and does not require your acceptance.

1. Controller

EMARIDE L.L.C-FZ Limited liability company (Free Zone), Meydan Free Zone Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba Dubai, United Arab Emirates Licence number: 2535707.01 Represented by its manager Ramez Mohamad Alkhalaf E-mail: info@emaride.ae

Data protection requests: privacy@emaride.ae

2. Scope

This policy applies to passengers, drivers and contact persons of fleet partners and business customers who use the Emaride platform in the UAE (together the "Platform"), and to persons who apply to become a fleet partner using the application form on www.emaride.ae. Users in the European Union are covered by the privacy policies of Emaride EU on www.emaride.lu; their data is stored separately in the EU.

3. Categories of Data Processed

Company records of fleet partners. Under D2.4 of the Terms of Use for the UAE, a fleet partner stores the records of its establishment on the Platform: the trade licence of the Department of Economy and Tourism, the tourist transport permit and the operation card of the RTA, proof of insurance and the Tourism Expert certificate of its manager. We store the file, the document type, the issue and expiry dates, the review status and, where applicable, the reason for a rejection; replaced versions are kept as history. The Tourism Expert certificate relates to the manager in person. The other records concern the establishment and contain personal data, such as the name of an owner, manager or signatory, only insofar as it appears on the document itself; the Platform has no separate fields for such details. An uploaded record is reviewed and approved only by Emaride staff. Access is limited to the users of the fleet partner's account and to Emaride staff authorised for fleet partners in the UAE; the files are kept in non-public storage with our hosting provider (Section 5). Before a record expires, the fleet partner's owner receives a reminder. An expired company record does not lock any account automatically.

Driver records. Under C3.1 of the Terms of Use for the UAE and the requirements of the Transport Authority, the following records are stored on the Platform for each driver: the UAE driving licence with its date of issue, the Emirates ID, the passport, the driver permit of the Transport Authority and the proof of the training it requires, the employment contract with the fleet partner, a medical fitness certificate and a certificate of good conduct. The medical fitness certificate contains health data, the certificate of good conduct data on criminal records; both are sensitive personal data under the PDPL. We use them only to verify that the driver meets the requirements of the Transport Authority and do not process them for any other purpose. From the date of issue of the driving licence we check whether the driver has held it for at least 2 years (Terms C3.1). We store the file, the document type, the issue and expiry dates, the review status and, where applicable, the reason for a rejection; replaced versions are kept as history. The records are uploaded by the driver or the employing fleet partner and reviewed and approved only by Emaride staff. Access is limited to the driver, the users of the employing fleet partner's account and Emaride staff authorised for drivers in the UAE; the files are kept in non-public storage with our hosting provider (Section 5). Before a record expires, a reminder is sent; an expired record locks app access automatically until a valid record is in place (Terms C3.2).

Proof of cleaning. Under D2.3 of the Terms of Use for the UAE, the driver submits once per calendar week a photo of the interior of the vehicle in the app; the fleet partner confirms it. We store the photo, the week, the status and who confirmed it when. If a confirmed proof is missing, the fleet partner's owner receives a reminder; the missing proof does not lock any account automatically.

Applications as a fleet partner. If you apply using the application form, we store the company name, the legal form, the country, the name, e-mail address and phone number of the contact person and your free-text description, together with the language of the form, the review status and, after the review, the decision, its reason and the reviewing person. As long as no Terms of Use for the UAE are in force, you apply without accepting them; you accept them when we invite you as a fleet partner. Once Terms of Use are in force, we additionally record which version you accepted, when, and from which IP address. To protect the form against mass submissions we count submissions per IP address; for this we store only a keyed code derived from the IP address, which is deleted after 2 days. We compare the e-mail address and phone number with our blocklist (Section 9); a match means that no application is created, and we inform you of this by e-mail without giving reasons. A match on the company or contact name does not stop the application but marks it for review by a person. A new application is notified to the responsible Emaride team by e-mail and in the dashboard and is reviewed by a person; there is no automated decision on an application.

Full payment card data is not stored by us but processed exclusively by the payment provider (Section 5).

4. Purposes and Legal Grounds

We process personal data only for specified purposes and to the extent necessary:

We do not send advertising or marketing messages and do not use advertising cookies on www.emaride.ae.

5. Recipients and Service Providers

• Fleet partners and drivers — to carry out the booked ride. Before acceptance the driver receives your first name, the verification status and the pickup and destination address; after acceptance additionally your phone number and rating average. E-mail address, surname and card details are never transmitted. For rides to or from an airport they receive the terminal as part of the destination or pickup and, for a pickup, the pickup time, never your flight number.
• Passengers — during a booked ride, the passenger sees the driver's first name, average rating with the number of ratings, the languages the driver has stated, the vehicle (category, make, model, colour, licence plate) and the driver's live position; once the driver has confirmed the ride and until it ends, additionally the driver's phone number. The driver's address, documents and bank details are never transmitted.
• Passengers booking nearby — while a driver is online and not on a ride, a signed-in passenger booking within 5 km may see a vehicle symbol near the driver. The driver's last position is rounded to a grid of about 400 m; only one symbol appears per grid cell, at most 12 in total, only vehicles of the chosen class if the passenger has chosen one, and the number of free vehicles only roughly (1, 3 or 6 and more). No name, vehicle, licence plate, direction of travel or identifier is shown. A driver who goes offline disappears within 4 minutes at the latest. Where a long-pickup surcharge applies, the passenger also sees, before an immediate ride, the straight-line distance from the nearest free driver to the pickup, rounded up to whole kilometres, and the resulting amount in the price breakdown.
• Authorities — where required by law, in particular the Roads and Transport Authority (RTA) of Dubai for regulatory reporting once the service is authorised.
• Service providers acting on our instructions:

Signing in with Apple or Google. Instead of a password or passkey, you can sign in with an Apple or Google account and link such an account to your Emaride account in the app's security settings, or unlink it again; one account can be linked per provider. This is voluntary. If you choose this option, we receive a signed confirmation from the provider containing an identifier of your Apple or Google account, your e-mail address (with Apple, a relay address if you wish) and, if you share it, your name. We use the confirmed e-mail address to match the sign-in to your existing account. Through this route we only create a new account as a passenger account in the app, after you have confirmed your country and the Terms of Use. We store the identifier and e-mail address of the link for as long as the link exists; if you unlink it or delete your account, we remove them. If you have set up two-factor sign-in, we also ask for the code after this sign-in. This processing is necessary for the performance of the contract with you. Apple and Google process the sign-in as independent controllers under their own privacy policies, also in the USA, and learn in the process that you are signing in to Emaride.

Avoiding duplicate accounts across regions. When you register, request a password reset or are invited, we check whether an account with your e-mail address already exists in our European database. For these three operations only a pseudonymous code derived from your e-mail address (a keyed hash) is transmitted; your address itself does not leave the region. If an account exists there, we inform you by e-mail how to sign in. This does not apply to signing in, see the next paragraph.

Signing in across regions. When you sign in with your e-mail address and password, we do not always know in advance in which region your account is held (for example on a new device or while travelling). If sign-in fails in the region asked first, we transmit your e-mail address and password in encrypted form (TLS) to the sign-in service of the other region (our European database, Supabase, Frankfurt data centre, or our UAE database in Mumbai, India). Unlike the check above, these are the credentials themselves, not a pseudonymous code. The sign-in service there uses them only to check the sign-in and does not store the password. Every failed attempt is recorded to protect against attacks in the region where it fails, even if sign-in then succeeds in the other region: in the protective log against repeated failed attempts, with a hash of your identifier and the IP address (deleted after 15 minutes), and in the audit log (retention as for log data, Section 7). The purpose is to let you sign in with one account in every region.

Check against known passwords. When you register, we check whether your password appears in known data breaches and reject it if so. For this we send only the first five characters of a SHA-1 hash of your password to the "Pwned Passwords" service of Have I Been Pwned; neither your password nor your e-mail address is transmitted, and the service cannot infer you or your password from these five characters.

6. Cross-Border Transfers

Our database for the UAE market is operated in India (Mumbai); further service providers are located in the USA, Canada and the EU (Section 5). Transfers outside the UAE take place only under the conditions of Articles 22 and 23 PDPL, in particular on the basis of contractual safeguards with the respective provider or where the transfer is necessary for the performance of the contract with you.

7. Retention Periods

8. Cookies

On www.emaride.ae we only use strictly necessary cookies: emaride_lang (display language, 1 year), emaride_country (market, 1 year), the session cookie of our sign-in (sb-…-auth-token, until you sign out or the session expires), emaride_remember (your "stay signed in" choice) and emaride_region (the region in which your account is kept, so that we connect you to the right database; 1 year). We do not use tracking or advertising cookies.

Loading time measurement. On all pages of www.emaride.ae, including the logged-in web area, we use Vercel Speed Insights to measure how fast the pages load and respond to input. After a page is opened, your browser sends to Vercel Inc. (USA) the page pattern without identifiers, parameters or fragment, the measured values (loading time, response time, layout shift), device type, browser, operating system, connection speed and the time; Vercel derives the country from your IP address. No cookies are set and no identifiers are stored on your device that would recognise you; your name, account or rides are not transmitted. The measurement runs without a consent dialog, based on our legitimate interest in a fast and stable website. No such measurement takes place in the app.

9. Automated Decisions

The penalty check for cancellations and no-shows, the automatic suspension when mandatory documents expire and the blocklist are prepared automatically. Measures with a significant effect on you — in particular the restriction or suspension of your account — are reviewed by a person at Emaride. You may object to a decision based solely on automated processing and request a human review via privacy@emaride.ae.

10. Your Rights

Under the PDPL you have the right to:

• obtain information about the processing of your data and a copy of it,
• request the transfer of your data,
• request correction of inaccurate data and erasure of data no longer required,
• request restriction of processing,
• request that processing stops, and
• object to decisions based solely on automated processing.

You can trigger a data export and the deletion of your account directly in the app. For everything else, contact privacy@emaride.ae. We respond within the periods set by law.

11. Complaints

You may lodge a complaint with the UAE Data Office if you believe that the processing of your personal data violates the PDPL.

12. Data Security

We use appropriate technical and organisational measures (including encryption in transit, role- and country-based access controls and separate storage of UAE and EU data) to protect your data.

13. Changes and Status of This Version

This version applies to the test phase of the Platform in the UAE and will be updated before rides can be booked. The current version is available on the website and in the app; it carries a version number and an effective date.