RYDE — Privacy Policy

Data Controller: RYDE · Riyadh, Kingdom of Saudi Arabia
Last updated: 23 June 2026

This Privacy Policy explains how RYDE collects, uses, shares, retains, and protects your personal data, in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia (Royal Decree M/19, as amended) and its Implementing and Data-Transfer Regulations issued by the Saudi Data & AI Authority (SDAIA). It forms part of our Terms of Service.

1. Who we are

The data controller is RYDE, Riyadh, Kingdom of Saudi Arabia. For any privacy question, request, or complaint, contact us through the in-app Help & Support section or at rydeksa.com.

2. Personal data we collect

Category	Examples
Identity & contact	Full name, email address, mobile number.
Organisational details	Designation/job title, company name, project leader (collected at sign-up for corporate accounts).
Account & authentication	Account identifier, one-time passcode (OTP) verification events, login activity.
Trip & location data	Pickup and drop-off locations, saved places, and — during an active Trip — real-time GPS location of the relevant device, route, and trip history.
Booking-on-behalf data	Where you book for another Traveller: that person’s name and mobile number, which you provide to us.
Billing data	Fares, invoices, VAT details, and corporate billing references.
Driver data (drivers only)	National ID / Iqama, driving licence, vehicle registration and photographs, plate details, and verification documents.
Device & technical	Device push-notification token, app version, and basic technical information needed to deliver the Service.
Communications	Support messages and correspondence with us.

We do not intentionally collect special-category data beyond what is necessary for driver verification and lawful operation. We do not knowingly collect data from anyone under 18.

3. Why we use your data and our legal basis

Purpose	PDPL legal basis
Create and manage your account; authenticate you (OTP)	Performance of a contract; your consent
Arrange, dispatch, and complete Trips; share necessary details with the assigned Driver	Performance of a contract
Show and track real-time location during a Trip for navigation, safety, and dispatch	Performance of a contract; your consent
Calculate fares; issue invoices; collect payment; meet tax/e-invoicing duties (ZATCA)	Legal obligation; performance of a contract
Customer support, safety, fraud prevention, and service security	Legitimate interests; legal obligation
Send service communications (OTP, booking updates, receipts/invoices, important notices)	Performance of a contract; legal obligation
Comply with TGA, SDAIA, and other lawful regulatory or law-enforcement requirements	Legal obligation

We send transactional emails only (such as OTP codes, booking updates, and invoices/receipts). We do not send marketing emails without your separate, opt-in consent.

Drivers — the minimum details needed to perform your Trip (e.g. Traveller name, contact number, pickup/drop-off).
RYDE dispatch and authorised administrators — to manage bookings and provide support.
Service providers (processors) acting on our instructions — see “Transfers outside the Kingdom” below.
Authorities — the Transport General Authority (TGA), SDAIA, tax authorities (ZATCA), courts, and law-enforcement, where required by law.
Successors — in connection with a corporate reorganisation, subject to this Policy and applicable law.

We do not sell your personal data.

5. Where your data is stored

Your core personal data (accounts, trips, locations, documents, and backups) is stored on infrastructure located inside the Kingdom of Saudi Arabia (Riyadh). Encrypted backups are also retained within the Kingdom.

6. Transfers outside the Kingdom

Some limited processing is performed by service providers outside the Kingdom. We carry out a transfer risk assessment and apply the safeguards required by the SDAIA Data-Transfer Regulation (such as approved Standard Contractual Clauses) before transferring personal data abroad. Current third parties that may process limited data outside the Kingdom:

Provider	Purpose	Data involved
Resend	Sending transactional emails (OTP, invoices, notices)	Recipient email address, name, message content
Expo / Google (FCM)	Delivering push notifications to your device	Device push token, notification content
Cloudflare	Content delivery and security for app assets and map tiles	Technical request data; no account profile data

We minimise the data shared with these providers to what is strictly necessary. We do not use third-party crash-reporting or analytics SDKs (such as Sentry) in our apps.

7. How long we keep your data

Account and profile data: for as long as your account is active, then deleted or anonymised within a reasonable period after closure, unless a longer period is required by law.
Trip and location records: retained for the period needed for operations, safety, and dispute resolution.
Tax invoices and financial records: retained for the period required by Saudi tax law (currently at least six years).
Driver verification documents: retained while the driver is active and for the period required by transport and record-keeping rules.

8. Your rights under the PDPL

Subject to the conditions in the PDPL, you have the right to:

Be informed about how your data is processed;
Access your personal data and obtain a copy of it;
Request correction of inaccurate or incomplete data;
Request destruction (deletion) of your data where it is no longer needed and no legal obligation requires us to keep it;
Withdraw your consent at any time (this does not affect prior lawful processing).

To exercise any right, contact us through the in-app Help & Support section or at rydeksa.com. We will respond within the timeframe required by law. If you are not satisfied, you have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

9. How we protect your data

In-Kingdom hosting with encrypted, access-controlled databases and encrypted backups;
Transport encryption (HTTPS/TLS) for data in transit;
Role-based access — staff and drivers see only the data they need;
OTP-based authentication and restricted administrative access;
Monitoring and logging to detect and respond to security events.

No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the risk.

10. Data breach

If a personal-data breach occurs that meets the notification threshold, we will notify SDAIA and affected individuals as required by the PDPL and its regulations.

11. Location data — your control

The apps use location to enable bookings, navigation, and live trip tracking. You can control location permissions through your device settings; disabling location will limit or prevent core features (such as live tracking and accurate dispatch). Driver location is processed while the driver is on-duty/online for dispatch and safety.

12. When someone books on your behalf

If another person books a Trip for you, they provide us your name and contact number to arrange the Trip. We process that data to deliver the Trip and in line with this Policy. Contact us through the in-app Help & Support section or at rydeksa.com with any questions about data held about you.

13. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date reflects the current version, and material changes will be notified through the app or by email where appropriate.

14. Contact us

RYDE — Data Protection Contact
Riyadh, Kingdom of Saudi Arabia
Contact: via the in-app Help & Support section or rydeksa.com