We, Mowasalat (Karwa) QPSC (hereinafter referred to as “Mowasalat” or “We”), are committed to protecting your personal data and your rights to data privacy. As a prime player in the public transport domain, our services are used across the State of Qatar. To avail our transport services, our customers need to provide certain personal data to enable us to connect them with our services and service providers. By accessing and using our services including but not limited our website, mobile apps, contact center, you acknowledge that we may collect and process your personal data as described in the Privacy Policy. Where required by law, we will seek your explicit consent before processing certain categories of personal data.

Mowasalat recognizes the importance of protecting your personal information and empowering you to control your data privacy. This Privacy Notice outlines our commitment to transparency and respect for your privacy rights, ensuring that your privacy is protected in accordance with the provisions of the Data Protection Law (No. 13 of 2016) of the State of Qatar and other applicable laws in force.

We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information that you provide online. We follow appropriate standards when it comes to protecting your privacy in relation to our services. We explain how your personal data is handled so you can be confident in how your information is used. This Privacy Notice ensures you understand our intent and your rights regarding your personal data with Mowasalat.

If we collect any personally identifiable information from you while you use our services, it will be handled and used strictly in accordance with our Privacy Policy. The Policy is described below:

• Mowasalat minimizes the collection and processing of personal data limited to relevant, necessary, and lawful purposes.
• Mowasalat seeks your consent before collecting and processing your personal data, which is obtained through affirmative actions such as checking a box, clicking “I Agree,” or similar unambiguous methods.
• Mowasalat implements adequate controls for the protection of your personal data.
• Mowasalat retains your personal data for a limited time required for consented and lawful purposes.
• Mowasalat anonymizes or securely erases your personal data that is no longer required for processing to protect against misuse and data breaches.
• Mowasalat follows industry best practices for managing personal data protection and processing.

We may periodically revise or update this Privacy Notice from time to time at our discretion to reflect developments in the law and best practices or in the provision of our services. The most recent version of this notice is available on our website (https://www.mowasalat.com). You are therefore encouraged to review it periodically to stay informed about improvements in the Notice.

If the changes are significant, we will make best efforts to provide you with a more prominent notice by sending an email notification and/or through the notifications tab in our platform. Notwithstanding this, changes to this Notice are effective when they are posted herein, and you acknowledge and agree that it is your responsibility to review them from time to time and become aware of the amendments. Your continued use of the platform will be deemed as the acceptance of any changes in this Notice.

We collect data from various sources, including but not limited to our website, mobile apps, contact center, government authorities, third-party agencies, other individuals acting on your behalf, and marketing or promotional platforms, to provide our services in compliance with the PDPPL and other applicable data protection laws. The scenarios in which we collect your information are outlined below:

• When you provide us with information directly, such as sharing your contact details (e.g., name, phone number, email address) to enable us to respond to your inquiries or booking requests.
• When you use our services—for example, when you create an account to access our services, book a ride, make payments, receive invoices, or offer/provide services to us.
• When you use our digital platforms, including our website, mobile app, or other online resources, to book rides, track your trips, make payments, view fare details, or access other transport-related information.
• When you engage with us through events or surveys, on social media, or by visiting our service centers or contacting us for support.
• When you provide your information for employment or partnership purposes, such as applying for roles as employees, contractors, or other relevant positions, or as part of your onboarding or contractual relationship with us.

• When you submit your details for marketing and promotional activities, such as subscribing to newsletters, participating in surveys, joining loyalty programs, or taking part in contests and promotions related to our transport services.
• When you interact with our content, services, or ads on our platforms or through third-party sites, we may receive information about your activities or interests (e.g., routes or services viewed) from those platforms or our service providers.
• If you share details about another individual, such as booking a service on their behalf, you must ensure you have their consent or proper authorization to provide us with their information.
• Any other information you choose to share when using our transport services or engaging with us.

We may collect your personal data directly from you, your authorized representatives, or others acting on your behalf to avail our transport services via, but not limited to, the following channels:

1. Mowasalat website (Mowasalat.com, Karwa.qa, Parent.karwaTechnologies.com, Karwadrivingschool.com)
2. Mowasalat mobile app (Karwa Taxi, Rihla and Karwa Journey Planner)

For security purposes, you may be monitored by electronic surveillance systems installed in our fleet.

We collect and process various types of personal data based on the nature of the relationship with Mowasalat and legal and regulatory requirements.

• Identification and Contact Information – Full name, Qatar ID, passport number, driving license number and license details, phone number, email address, home and work addresses, PO Box number, fax number and other identification documents.
  • Demographic and Personal Information – Nationality, gender, date of birth/age, marital status, family details (such as spouse and children), religious affiliation
  • Employment and Educational Details – Employee ID (for staff), past employment details, contracting company name, company name, academic qualifications, certificates, and school/class details (for children), work authorization or visa status.
  • Legal and Compliance Information – Criminal history, background check information.
  • Financial and Commercial Information – Subscription plans, purchased, used, or interested offerings, attended events, invoice records, payment details, billing information, bank details, and account information.
  • Medical and Health Data – Health and medical details, physical disabilities, and psychological conditions.
  • Media, Electronic, and System Data – Profile picture, signature, photographs, video footage, system/application logs, call and chat records with customer support, complaint details and resolutions, service history, preferred communication methods, and marketing preferences.

• Usage and Analytics Data – Ride booking history, app usage patterns, interactions with pages, clicks, time spent on the app, forms completed (including incomplete ones), and engagement with advertisements or promotions.
  • Consent Information – Records of consents provided, including date and time, means of consent, and related details (e.g., scope of consent).
  • Other Personal Information: Any additional details you voluntarily provide while using our transportation services.

The above personal information includes sensitive personal data or personal data with special nature as defined under the Personal Data Privacy Protection Law (PDPPL). This data is collected and processed only after obtaining the explicit consent required under PDPPL.. This information is collected and processed in accordance with legal, regulatory, and contractual requirements to enhance your experience and maintain the safety and efficiency of our services.

We may also collect or automatically generate certain Personal Information based on your interactions with us, such as when you use our transport services, and may associate that information with your account. This information typically includes:

• Identifiers such as unique user identifiers, device identifiers, IP addresses, booking reference numbers, and usernames.
  • Geolocation information such as real-time GPS coordinates, region, country, state, Zip code, or postal code.
  • Information automatically collected as you use our transport services, including the details of your bookings, routes traveled, ride duration, and frequency of usage.
  • Electronic information, such as details about your device (e.g., browser type, operating system, device characteristics), information related to app usage, updates, technical errors, and system performance.
  • Commercial information such as booking history, completed rides, and preferences related to transport services.
  • Communication data such as in-app chat or call logs with drivers, customer support interactions, feedback, and ratings.
  • Payment and transaction details such as fare breakdowns, billing information, promo code usage, and refund or dispute history.
  • Security and fraud prevention data such as login and authentication details, behavioral patterns to detect suspicious activities, and records of complaints, disputes, or reports of misconduct.
  • Technical monitoring to ensure system security and performance, including IP addresses, network packet addresses, and other technical data to protect against unauthorized access, misuse, or data breaches.

These details help us manage and improve your transport services while adhering to applicable data protection laws.

We process your personal data based on the lawful basis of providing you with our transportation and related services, and in compliance with our legal, regulatory, and contractual requirements. The purposes for which we collect and process your personal data are described below.

Permitted Reasons for Processing

• Consent: Where we have your consent, in accordance with the PDPPL, you may withdraw your consent at any time (subject to applicable conditions) by contacting us through the details provided in the “Contact Us” section,. but we may continue to use your information for purposes which are not reliant on consent. Withdrawal does not affect lawfulness of processing conducted prior to the receipt of your request.
• Contractual Obligations: When processing your Personal Data is necessary to fulfill our contractual obligations, including delivering our services to you or taking steps prior to entering into a contract.
• Legal Obligations: Where processing is required to comply with legal obligations, cooperate with law enforcement or regulatory authorities, establish, exercise, or defend legal claims, or disclose information as evidence in legal proceedings.
• Legitimate Interest: When processing is reasonably necessary to support our legitimate business interests, provided these do not override your rights, freedoms, or interests under data protection and other relevant laws. This includes administering our websites and events, conducting internal operations such as troubleshooting, data analysis, testing, statistical research, and surveys to enhance our services.

When processing your Personal Information based on our legitimate interests, we carefully balance our interests against your rights to ensure that your privacy is not unduly affected.

We process your Personal Information for specific purposes, depending on how you engage with our services, including:

• Validating Your Identity: To verify your identity as necessary to provide services under our agreement with you.
• Managing User Accounts: To create, authenticate, and maintain user accounts, enforce our terms of use, and ensure your account remains active and secure.
• Providing Services: To deliver transportation booking services and related offerings, such as analyzing usage data for billing, discounts, or other contractual obligations.
• Customer Support: To assist with your use of our services, respond to inquiries or feedback, and resolve issues such as ride-related concerns, which may involve a follow-up call or email.
• Communicating with You: To send technical notifications, updates to terms and conditions, security alerts, booking confirmations, transaction receipts, and invoices.
• Fulfilling and Managing Orders: To handle your ride bookings, payments, refunds, and other transactions related to transportation services.
• Marketing and Promotions: To share relevant offers for our services or third-party services that might interest you, and to deliver sponsored content or advertisements upon your request.
• Analyzing Usage Trends: To audit, research, and analyze usage patterns for improving our services and making informed business decisions.
• Ensuring Safety: To protect an individual’s life, safety, and well-being, or prevent harm to others when necessary.
• Protecting Rights and Complying with Legal Obligations: To safeguard our property, rights, and users’ safety, and to comply with legal requirements or valid legal processes.
• Legitimate Business Operations: To support business functions like fraud prevention, data analytics, administrative tasks, network security, and enhancing our services’ performance.

These processing activities are carried out in compliance with applicable laws and based on lawful grounds, including fulfilling contracts, obtaining consent, and ensuring legitimate business interests

Sharing of data with Third Parties:

To support our operations and ensure efficient service delivery, Mowasalat may share Personal Data with authorized third parties, including government agencies, financial institutions, healthcare providers, telecommunications companies, technology service providers, transportation partners, and payment processors. Where required, such sharing will be based on the individual’s consent, in accordance with applicable laws. These disclosures are conducted under strict contractual agreements to ensure data protection, confidentiality, and compliance with regulatory

We deploy adequate safeguards in line with industry best practices to ensure the security of your personal data. To prevent unauthorized access to or disclosure of your personal data, we have put organizational, physical, technical, and administrative controls in place.

• Your personal data is stored and processed within Mowasalat systems and applications to provide you with our services.
• Our systems and applications are securely hosted within the boundaries of the State of Qatar.
• Our systems and applications are access-controlled to prevent unauthorized access to your personal data.
• Where necessary, we use encryption technologies to protect your personal data at rest and in transit.
• We deactivate your account after a specified period of inactivity following your last login or interaction with our systems and applications.
• We retain your personal data for as long as necessary to fulfill the consented purpose for which it was collected as described in this Privacy Notice and in line with our data retention policies or as required by relevant legal, regulatory, and contractual requirements.
• We erase your personal data using commercially viable and technically feasible measures to make your personal data irrecoverable.
• We do not sell and share your personal data to third parties for marketing and other promotional purposes.
• No third party has access to your personal data unless required by law or explicitly authorized by your consent.
• While we use reasonable efforts to protect your personal data, Mowasalat shall not be held liable for any losses, damages, claims, or issues arising from the security of your personal data due to reasons beyond our control, including but not limited to the ever-increasing threat of cyber-attacks. We will notify you as soon as reasonably possible upon becoming aware of a privacy breach involving your Personal Information, in accordance with the PDPPL

Your consent is important for us to proceed with processing your personal data. If you choose to opt-out, you may not be able to use all or some of our services.

You, and the entities supplying the personal data on your behalf, shall be responsible for the consent given to us for collection and processing of your personal data. We do not assume responsibility for entities acting on your behalf for consenting the collection and processing of your personal data.

Where you disclose personal data on behalf of another person, you are responsible for ensuring that the individual whose personal data is supplied to us has authorized the disclosure, is informed of, and, where appropriate, consents to our processing of their personal data in accordance with this Privacy Notice. Where the personal data is of a minor, you should provide consent on their behalf only if you are the minor’s legal guardian

You have the following rights for your personal data:

• You have a right to know what personal data is collected, how it is protected, why we need to process it, how long we retain it, and whom it is shared with and for what purpose.
• You also have the right to access, and update your personal data, withdraw your consent for processing your personal data, where applicable, and request for erasure of your personal data.
• You also have the right to object and the right to be informed if there is an inaccurate disclosure of your data.
• Rights of minors can be exercised by their legal guardians.

This Privacy Notice serves the purpose of notifying individuals about the need for Mowasalat’s collection and processing of personal data.

We are committed to addressing any concerns you may have regarding the handling of your personal information by us or on our behalf. Should you have any inquiries, issues, or wish to exercise your data privacy rights, please contact us at privacy@mowasalat.com, providing sufficient details to enable a thorough review and an appropriate response. If you believe your request has not been handled appropriately or are dissatisfied with how your rights under the PDPPL have been managed, you may file a complaint with the National Cyber Governance and Assurance Affairs department of the National Cyber Security Agency (NCSA) or with the relevant supervisory authority in the jurisdiction where the alleged issue occurred, where you work, or where you usually reside.