PRIVACY POLICY
Version: 1.0
Last Updated: September 2026
1. Introduction
Welcome to Haulerz, a digital logistics platform owned and operated by Transformation Logistics Company, Commercial Registration No. 7017320214 ("Haulerz", the "Company", "we", "our", or "us").
The Company is committed to protecting the privacy of all users of its digital platforms and considers the protection of Personal Data to be one of the fundamental principles governing its operations.
This Privacy Policy explains how we collect, use, process, store, disclose, transfer, and protect Personal Data when you access or use our website, mobile applications, digital platforms, customer support channels, or any services provided by Haulerz.
This Privacy Policy has been prepared in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Implementing Regulations, together with any other applicable legal or regulatory requirements.
By accessing or using the Platform, creating an account, requesting transportation services, or otherwise interacting with Haulerz, you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your Personal Data as described herein, to the extent permitted by applicable law.
2. About Haulerz
Haulerz is a technology-enabled logistics platform that connects customers requiring transportation and delivery services with qualified transportation providers.
Transportation services may be performed through:
- Vehicles owned or operated by the Company;
- Drivers employed or contracted by the Company;
- Third-party transportation companies contracted by the Company;
- Any other logistics service provider authorized by the Company.
The Company reserves the right to determine the most appropriate service provider for each shipment based on operational requirements, service availability, shipment characteristics, geographic location, customer requirements, and service efficiency.
3. Purpose of this Privacy Policy
This Privacy Policy aims to:
- Explain what Personal Data we collect;
- Explain why we collect and process Personal Data;
- Describe how Personal Data is used and disclosed;
- Explain how Personal Data is protected;
- Describe the rights available to Data Subjects;
- Explain how users may contact us regarding privacy matters;
- Demonstrate our commitment to transparency, accountability, and compliance with applicable laws.
4. Scope of Application
This Privacy Policy applies to all services provided by Haulerz, including but not limited to:
- Our website;
- Mobile applications;
- Customer portals;
- Driver applications;
- Corporate customer portals;
- APIs and digital integrations (where applicable);
- Customer support services;
- Any future services provided by the Company unless governed by a separate privacy policy.
5. Definitions
For purposes of this Privacy Policy, the following terms shall have the meanings assigned below unless the context requires otherwise.
Company
Transformation Logistics Company, the legal owner and operator of Haulerz.
Haulerz
The trade name, digital platform, website, applications, and related services operated by the Company.
Platform
All websites, mobile applications, systems, software, digital services, and electronic channels operated by the Company.
User
Any individual or legal entity accessing or using the Platform.
Customer
A person or business requesting transportation, logistics, delivery, or related services through the Platform.
Driver
An individual performing transportation services, whether employed by the Company, contracted directly by the Company, or engaged through an authorized transportation partner.
Transportation Company
Any licensed transportation or logistics company contracted by Haulerz to perform transportation services.
Recipient
The individual designated to receive a shipment at its final destination.
Shipment
Any package, parcel, goods, documents, merchandise, or other items accepted for transportation in accordance with applicable laws and Company policies.
Personal Data
Any information relating to an identified or identifiable natural person, whether directly or indirectly identifiable.
Processing
Any operation performed on Personal Data by automated or non-automated means, including collection, recording, organization, storage, modification, retrieval, consultation, use, disclosure, transfer, dissemination, restriction, anonymization, deletion, or destruction.
Service Provider
Any third party engaged by the Company to provide services supporting the operation of the Platform, including payment processors, cloud hosting providers, mapping services, identity verification providers, messaging providers, analytics providers, cybersecurity providers, or similar vendors.
Force Majeure
Any event beyond the reasonable control of the Company that prevents or delays performance, including natural disasters, epidemics, war, civil disturbances, governmental actions, interruptions of communication services, or other extraordinary events.
6. General Principles of Personal Data Processing
The Company processes Personal Data in accordance with the following principles:
- Lawfulness, fairness, and transparency;
- Purpose limitation;
- Data minimization;
- Accuracy of Personal Data;
- Appropriate security safeguards;
- Storage limitation;
- Accountability;
- Respect for the rights of Data Subjects;
- Compliance with applicable laws and regulatory requirements.
The Company shall process only the Personal Data necessary to achieve legitimate business, contractual, operational, or legal purposes and shall not process Personal Data in a manner inconsistent with those purposes unless otherwise permitted by applicable law.
7. Categories of Personal Data We Collect
The Company follows the principle of data minimization and collects only the Personal Data that is necessary to provide its services, comply with legal obligations, protect legitimate interests, and improve the operation of the Platform.
The categories of Personal Data collected vary depending on your relationship with the Company, including whether you are a Customer, Driver, Transportation Company, Corporate Customer, Recipient, or visitor to our Platform.
7.1 Account Registration Information
When creating an account, we may collect information including:
- Full name;
- Mobile phone number;
- Email address;
- Encrypted password;
- Preferred language;
- City or region;
- Account type (Individual, Business, or Driver);
- Account creation date;
- Account status;
- Internal customer identification number.
7.2 Identity Verification Information
Where required by law or for operational purposes, the Company may request information including:
- National ID number;
- Iqama number;
- Passport number;
- Date of birth;
- Identity document expiry date;
- Copies of identification documents;
- Personal photograph where required;
- Identity verification records;
- Verification results.
Identity verification information is processed solely for legitimate purposes including regulatory compliance, fraud prevention, security, and customer verification.
7.3 Corporate Customer Information
For business customers, the Company may collect:
- Company name;
- Commercial Registration number;
- VAT registration number;
- Authorized representative information;
- Billing information;
- Business address;
- Contact details;
- Payment and invoicing information.
7.4 Driver Information
Drivers and transportation service providers may be required to provide:
- Full name;
- National ID or residency information;
- Contact information;
- Driving licence details;
- Licence expiry date;
- Vehicle registration documents;
- Insurance information;
- Vehicle specifications;
- Vehicle model and year;
- Vehicle registration plate number;
- Vehicle photographs;
- Bank account information for payment processing;
- Operational performance records;
- Customer ratings and feedback;
- Compliance and disciplinary records relating to Platform use.
7.5 Shipment Information
To perform transportation services, the Company may collect:
- Pickup location;
- Delivery location;
- GPS coordinates;
- Sender information;
- Recipient information;
- Contact numbers;
- Shipment description;
- Number of packages;
- Weight;
- Dimensions;
- Declared shipment value where applicable;
- Delivery instructions;
- Supporting photographs;
- Shipment documentation;
- Pickup and delivery timestamps;
- Shipment status;
- Operational notes.
7.6 Location Information
Because transportation services depend on location data, the Company may collect GPS information relating to Customers and Drivers.
Such information may include:
- Current location;
- Pickup location;
- Delivery location;
- Travel route;
- Route history;
- Estimated arrival time;
- Travel duration;
- Operational stops;
- Navigation-related information.
For Drivers, location information may continue to be collected while the Driver Application is operating in the background during active transportation services, subject to the permissions granted on the device and applicable legal requirements.
7.7 Device and Technical Information
The Platform may automatically collect technical information, including:
- Internet Protocol (IP) address;
- Device identifier;
- Device manufacturer;
- Device model;
- Operating system;
- Application version;
- Browser type;
- Browser version;
- Language settings;
- Time zone;
- Diagnostic information;
- Crash reports;
- Login history;
- Security logs.
7.8 Payment Information
When electronic payment services are used, the Company may process information including:
- Transaction reference number;
- Transaction amount;
- Payment date and time;
- Payment status;
- Payment method;
- Invoice number;
- Refund information;
- Digital wallet information where applicable.
The Company does not store complete payment card information where payments are processed by certified third-party payment providers.
7.9 Customer Support Information
Where users contact Customer Support, the Company may process:
- Telephone call records where recording is permitted;
- Chat communications;
- Email correspondence;
- Support tickets;
- Complaints;
- Suggestions;
- Investigation records;
- Customer service outcomes.
7.10 Proof of Delivery Information
To verify successful completion of transportation services, the Company may collect:
- One-Time Password (OTP);
- Recipient signature;
- Delivery photographs;
- Delivery location photographs;
- Recipient name;
- Delivery timestamp;
- GPS coordinates at delivery;
- Any other electronic verification method approved by the Company.
7.11 Usage Information
During use of the Platform, the Company may generate additional operational information including:
- Order history;
- Search history;
- Notification history;
- Service preferences;
- Loyalty programme information where applicable;
- Promotional campaign participation;
- Referral programme information;
- Customer ratings;
- Usage analytics.
7.12 Information Obtained from Third Parties
The Company may receive Personal Data from third parties, including:
- Transportation partners;
- Payment service providers;
- Identity verification providers;
- Mapping and navigation providers;
- SMS and communication providers;
- Government authorities where legally permitted;
- Third parties authorized by the Data Subject.
7.13 Information We Do Not Sell
The Company does not sell, lease, rent, or commercially trade Personal Data.
Personal Data is processed solely for legitimate operational, contractual, legal, security, and business purposes consistent with this Privacy Policy and applicable law.
8. Purposes and Legal Bases for Processing Personal Data
The Company processes Personal Data only where there is a lawful basis for doing so and only to the extent necessary to achieve legitimate operational, contractual, regulatory, or business objectives.
Personal Data shall not be processed for purposes incompatible with those for which it was originally collected unless such processing is permitted by applicable law or the Data Subject has provided any consent required by law.
8.1 Account Creation and Administration
Personal Data is processed to:
- Create and activate user accounts;
- Verify user identity;
- Authenticate login credentials;
- Maintain account security;
- Enable password recovery;
- Update account information;
- Manage user permissions;
- Provide customer support;
- Prevent unauthorized access.
8.2 Provision of Transportation Services
The Company processes Personal Data in order to:
- Receive transportation requests;
- Match shipments with suitable Drivers or Transportation Companies;
- Schedule transportation services;
- Coordinate pickup and delivery;
- Monitor shipment progress;
- Verify successful delivery;
- Resolve operational issues;
- Provide shipment tracking;
- Manage transportation documentation.
8.3 Customer Relationship Management
Personal Data may be processed to:
- Respond to enquiries;
- Handle customer complaints;
- Investigate reported issues;
- Provide customer assistance;
- Send service-related notifications;
- Improve customer satisfaction;
- Maintain communication records.
8.4 Driver and Transportation Provider Management
Where applicable, Personal Data may be processed to:
- Verify driver eligibility;
- Verify licences and regulatory documentation;
- Monitor operational performance;
- Allocate transportation requests;
- Process compensation and settlements;
- Evaluate service quality;
- Maintain safety standards;
- Comply with transportation regulations.
8.5 Corporate Customer Management
For business customers, Personal Data may be processed to:
- Establish commercial relationships;
- Manage contractual obligations;
- Issue quotations;
- Process invoices;
- Maintain customer accounts;
- Generate operational reports;
- Manage service-level commitments;
- Support account administration.
8.6 Payment Processing
The Company processes Personal Data for purposes including:
- Processing electronic payments;
- Confirming successful transactions;
- Detecting fraudulent transactions;
- Processing refunds;
- Maintaining financial records;
- Complying with financial and regulatory obligations.
8.7 Fraud Prevention and Security
Personal Data may be processed to:
- Protect the Platform against cyber threats;
- Detect suspicious activity;
- Prevent fraudulent transactions;
- Investigate security incidents;
- Protect Customers, Drivers, and the Company;
- Preserve the integrity of Company systems.
8.8 Compliance with Legal and Regulatory Obligations
The Company may process Personal Data where necessary to:
- Comply with applicable laws and regulations;
- Respond to lawful requests from governmental authorities;
- Comply with judicial orders;
- Maintain legally required records;
- Cooperate with competent regulatory authorities;
- Exercise or defend legal rights.
8.9 Service Improvement
The Company continuously seeks to improve its services and may process Personal Data to:
- Improve operational efficiency;
- Enhance user experience;
- Develop new products and services;
- Improve shipment allocation;
- Improve route optimization;
- Evaluate service quality;
- Produce operational statistics;
- Conduct internal reporting.
Where reasonably possible, such analysis is performed using aggregated or anonymized information.
8.10 Marketing Communications
Subject to applicable law, the Company may process contact information to:
- Send promotional campaigns;
- Inform users about new services;
- Provide special offers;
- Conduct customer surveys;
- Send newsletters;
- Promote Company events.
Where consent is required by applicable law, marketing communications shall only be sent after obtaining the appropriate consent.
Users may opt out of marketing communications at any time through the methods provided by the Company.
8.11 Location Data Processing
Because transportation services depend upon accurate geographical information, the Company processes location data for purposes including:
- Identifying pickup locations;
- Identifying delivery destinations;
- Navigation assistance;
- Route optimization;
- Driver allocation;
- Shipment tracking;
- Estimated arrival calculations;
- Proof of delivery;
- Investigation of complaints;
- Operational analytics;
- Safety and security.
Location information is processed only to the extent necessary for providing transportation services or where otherwise permitted by applicable law.
9. Legal Bases for Processing Personal Data
Depending on the circumstances, the Company relies upon one or more of the following legal bases for processing Personal Data.
9.1 Performance of a Contract
Processing is necessary for entering into, performing, or administering a contract with the Data Subject, including:
- Creating user accounts;
- Accepting transportation requests;
- Processing deliveries;
- Communicating regarding services;
- Managing customer relationships;
- Processing payments.
9.2 Compliance with Legal Obligations
Processing may be necessary to comply with obligations imposed by applicable laws and regulations, including obligations relating to:
- Financial reporting;
- Tax compliance;
- Regulatory reporting;
- Judicial proceedings;
- Government requests;
- Record retention requirements.
9.3 Legitimate Interests
The Company may process Personal Data where necessary for its legitimate interests, provided such interests do not override the rights and freedoms of the Data Subject.
Legitimate interests may include:
- Fraud prevention;
- Information security;
- Service improvement;
- Operational management;
- Internal auditing;
- Risk management;
- Business continuity;
- Statistical analysis;
- Protection of Company assets.
9.4 Consent
Where required by applicable law, the Company shall obtain the Data Subject's consent before processing Personal Data.
Examples include:
- Certain marketing communications;
- Optional features;
- Processing activities requiring explicit consent under applicable law.
Where processing is based upon consent, the Data Subject may withdraw such consent at any time.
Withdrawal of consent shall not affect the lawfulness of processing carried out prior to the withdrawal, nor shall it affect processing based upon another lawful basis.
9.5 Vital Interests
The Company may process Personal Data where necessary to protect the life, health, or safety of a Data Subject or another individual, as permitted by applicable law.
9.6 Legal Claims and Dispute Resolution
Personal Data may be processed where necessary to:
- Establish legal claims;
- Exercise legal rights;
- Defend legal proceedings;
- Resolve disputes;
- Enforce contractual obligations;
- Protect the Company's legitimate interests.
9.7 Requests from Competent Authorities
The Company may process or disclose Personal Data where required by a lawful request issued by:
- Courts;
- Government authorities;
- Regulatory authorities;
- Law enforcement agencies;
- Other competent authorities authorized under applicable laws of the Kingdom of Saudi Arabia.
Such disclosure shall be limited to the extent required by applicable law.
10. Disclosure and Sharing of Personal Data
The Company recognizes the importance of maintaining the confidentiality of Personal Data and does not sell, rent, lease, or commercially exploit Personal Data.
Personal Data is disclosed only where such disclosure is necessary to provide our services, perform contractual obligations, comply with applicable laws, protect legitimate interests, or with the consent of the Data Subject where required.
Whenever Personal Data is shared, the Company applies the principle of data minimization and discloses only the information necessary to achieve the intended purpose.
10.1 Disclosure to Drivers
To perform transportation services, the Company may disclose certain Personal Data to the assigned Driver, including:
- Customer name;
- Pickup location;
- Delivery location;
- Sender information;
- Recipient information;
- Contact telephone number where operationally necessary;
- Shipment description;
- Delivery instructions;
- Proof of Delivery (POD) verification code (OTP);
- Other information reasonably required to complete the transportation service.
Drivers are contractually prohibited from using Personal Data for any purpose other than providing the transportation service and must maintain the confidentiality of all Personal Data received.
10.2 Disclosure to Transportation Companies
Where transportation services are performed by third-party transportation companies contracted by the Company, Personal Data necessary for completing the shipment may be disclosed, including:
- Customer information;
- Sender information;
- Recipient information;
- Shipment details;
- Pickup and delivery locations;
- Contact information;
- Delivery instructions;
- Shipment status.
Transportation Companies are required to:
- Process Personal Data only in accordance with the Company's instructions;
- Maintain appropriate technical and organizational security measures;
- Comply with applicable privacy and data protection laws;
- Protect the confidentiality of Personal Data;
- Notify the Company of any security incident affecting Personal Data where required by contract or law.
10.3 Payment Service Providers
The Company may disclose Personal Data to authorized payment service providers for purposes including:
- Payment authorization;
- Transaction processing;
- Fraud detection;
- Refund processing;
- Financial reconciliation;
- Regulatory compliance.
Payment card information is processed directly by certified payment providers where applicable.
The Company does not intentionally retain complete payment card details unless expressly permitted by applicable law and industry standards.
10.4 Technology Service Providers
The Company relies on carefully selected third-party technology providers to support the operation of the Platform.
These providers may include:
- Cloud hosting providers;
- Data storage providers;
- Identity verification providers;
- Mapping and navigation service providers;
- SMS gateway providers;
- Email service providers;
- Cybersecurity service providers;
- Analytics providers;
- Customer support platforms;
- System monitoring providers.
Such providers receive only the information necessary to perform their contracted services and are required to implement appropriate security measures.
10.5 Corporate Customers
Where transportation services are provided on behalf of corporate customers, the Company may disclose operational information including:
- Shipment status;
- Pickup confirmation;
- Delivery confirmation;
- Proof of Delivery;
- Delivery timestamps;
- Performance reports;
- Billing information;
- Contractual reporting information.
Such disclosures are limited to information necessary for the performance of contractual obligations.
10.6 Government Authorities
The Company may disclose Personal Data where required by law or pursuant to a lawful request from competent authorities, including:
- Courts;
- Judicial authorities;
- Government agencies;
- Regulatory authorities;
- Law enforcement agencies;
- Other legally authorized public authorities.
Disclosure shall be limited to the scope required under applicable laws.
10.7 Legal Protection
The Company may process or disclose Personal Data where necessary to:
- Protect its legal rights;
- Enforce contractual obligations;
- Recover outstanding amounts;
- Defend legal proceedings;
- Investigate fraud;
- Protect Customers, Drivers, Transportation Companies, employees, or the public;
- Prevent illegal activities.
10.8 Corporate Transactions
If the Company undergoes a merger, acquisition, restructuring, sale of assets, financing transaction, or other corporate reorganization, Personal Data may be transferred to the relevant successor entity.
The Company shall take reasonable measures to ensure that any successor continues to process Personal Data in accordance with applicable laws and this Privacy Policy.
11. International Transfers of Personal Data
The Company primarily stores and processes Personal Data within the Kingdom of Saudi Arabia.
However, certain technology service providers may process Personal Data in other jurisdictions where operationally necessary.
Where Personal Data is transferred outside the Kingdom, the Company shall ensure that such transfer is conducted in accordance with the Personal Data Protection Law (PDPL) and any applicable regulatory requirements.
Appropriate safeguards may include:
- Contractual data protection obligations;
- Security assessments;
- Approved cross-border transfer mechanisms;
- Confidentiality obligations;
- Technical and organizational security controls.
The Company shall not transfer Personal Data internationally unless a lawful basis exists and appropriate safeguards have been implemented.
12. Obligations of Third Parties Receiving Personal Data
Any third party receiving Personal Data from the Company is expected, where applicable, to:
- Process Personal Data only for authorized purposes;
- Maintain confidentiality;
- Implement appropriate technical and organizational safeguards;
- Prevent unauthorized access;
- Comply with applicable privacy and data protection laws;
- Notify the Company of relevant security incidents;
- Return or securely delete Personal Data upon completion of the agreed services unless retention is required by law.
The Company may periodically evaluate the compliance of service providers with contractual privacy and security obligations.
13. No Sale of Personal Data
The Company does not sell Personal Data to any third party.
The Company also does not rent, lease, commercially exploit, or exchange Personal Data for monetary or commercial consideration.
Any disclosure of Personal Data is undertaken solely for legitimate operational, contractual, regulatory, security, or legal purposes in accordance with this Privacy Policy and applicable law.
14. Confidentiality Obligations
Employees, contractors, consultants, and service providers who have access to Personal Data are subject to confidentiality obligations appropriate to the nature of their responsibilities.
Access to Personal Data is granted only on a need-to-know basis and is limited to personnel whose duties require such access.
The Company maintains internal policies and procedures designed to prevent unauthorized disclosure or misuse of Personal Data.
15. Information Security
The Company is committed to protecting Personal Data through appropriate administrative, technical, organizational, and physical safeguards designed to prevent unauthorized access, disclosure, alteration, loss, misuse, destruction, or other unlawful processing.
Security measures are implemented in a manner proportionate to the nature, sensitivity, volume, and risks associated with the Personal Data processed by the Company.
While no security system can guarantee absolute protection, the Company continuously reviews and enhances its security controls to reduce risks and strengthen the protection of Personal Data.
15.1 Technical Security Measures
The Company implements a range of technical safeguards, which may include:
- Encryption of data during transmission using secure communication protocols;
- Encryption of sensitive data at rest where appropriate;
- Multi-layer network security controls;
- Firewalls and intrusion detection/prevention systems;
- Anti-malware protection;
- Continuous security monitoring;
- System logging and audit trails;
- Security patch management;
- Vulnerability management;
- Secure backup procedures;
- Disaster recovery capabilities.
15.2 Access Control
Access to Personal Data is strictly limited to authorized personnel whose duties require such access.
The Company applies the principle of least privilege, ensuring that individuals receive only the minimum level of access necessary to perform their assigned responsibilities.
Access rights are periodically reviewed and revoked when no longer required.
15.3 Account Security
The Company employs appropriate security mechanisms to protect user accounts, including:
- Identity verification procedures;
- Password encryption;
- One-Time Password (OTP) verification where appropriate;
- Login monitoring;
- Device authentication where applicable;
- Detection of suspicious login attempts;
- Session management controls.
Users are responsible for maintaining the confidentiality of their login credentials and should immediately notify the Company of any suspected unauthorized access.
15.4 Employee Awareness
The Company promotes a culture of privacy and information security by providing appropriate training and awareness programs to employees, contractors, and authorized personnel.
Personnel handling Personal Data are expected to understand and comply with the Company's privacy, confidentiality, and information security requirements.
15.5 Security Assessments
The Company may periodically conduct:
- Internal security reviews;
- Risk assessments;
- Security audits;
- Penetration testing;
- Vulnerability assessments;
- Compliance reviews.
The objective of these activities is to continuously improve the effectiveness of the Company's security controls.
16. Data Retention
The Company retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, enforce contractual rights, or satisfy legitimate business requirements.
Once Personal Data is no longer required, it shall be securely deleted, anonymized, or destroyed unless retention is required by applicable law.
16.1 Retention Criteria
The retention period applicable to Personal Data may depend upon:
- The purpose of processing;
- Applicable legal or regulatory requirements;
- Contractual obligations;
- Business operational needs;
- Litigation or dispute resolution requirements;
- Fraud prevention requirements;
- Financial reporting obligations.
16.2 Categories of Retained Information
Depending upon the nature of the services provided, the Company may retain records including:
- Customer account information;
- Driver records;
- Transportation records;
- Shipment history;
- Proof of Delivery records;
- Payment and invoicing records;
- Customer support records;
- Communication logs;
- Security logs;
- Audit records;
- Regulatory compliance records.
Retention periods may vary according to the applicable legal, contractual, or operational requirements.
17. Secure Deletion and Destruction
Where Personal Data is no longer required, the Company shall take reasonable measures to securely dispose of such information.
Depending upon the storage medium, disposal methods may include:
- Secure electronic deletion;
- Permanent destruction of storage media;
- Cryptographic erasure where applicable;
- Irreversible anonymization;
- Secure shredding of physical records.
The Company seeks to ensure that deleted Personal Data cannot reasonably be reconstructed or recovered.
18. Rights of Data Subjects
Subject to applicable law, Data Subjects may exercise certain rights concerning their Personal Data.
The availability of these rights may depend upon the legal basis for processing and any applicable legal exceptions.
18.1 Right to Be Informed
Data Subjects have the right to understand:
- Why Personal Data is collected;
- The legal basis for processing;
- The purposes of processing;
- Categories of Personal Data collected;
- Categories of recipients;
- Retention practices;
- Available privacy rights.
18.2 Right of Access
Data Subjects may request confirmation as to whether the Company processes their Personal Data and, where applicable, request access to such information in accordance with applicable law.
18.3 Right to Obtain a Copy
Where legally permitted, Data Subjects may request a copy of their Personal Data in an appropriate format.
The Company may apply reasonable verification procedures before releasing Personal Data.
18.4 Right to Rectification
Where Personal Data is inaccurate, incomplete, or outdated, Data Subjects may request correction or updating of such information.
The Company may request supporting documentation before making requested corrections.
18.5 Right to Erasure
Subject to legal and contractual obligations, Data Subjects may request deletion of Personal Data where:
- The data is no longer required;
- Processing is no longer lawful;
- Consent has been withdrawn where consent is the legal basis;
- Applicable law provides such right.
The Company may decline deletion requests where continued retention is legally required or necessary to protect legitimate legal interests.
18.6 Right to Withdraw Consent
Where processing is based upon consent, the Data Subject may withdraw consent at any time.
Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.
18.7 Right to Lodge a Complaint
If a Data Subject believes that Personal Data has been processed in violation of applicable law or this Privacy Policy, the individual may submit a complaint to the Company.
Where permitted by applicable law, the Data Subject may also refer the matter to the competent supervisory authority.
19. Exercising Privacy Rights
Requests relating to Personal Data may be submitted through the Company's official communication channels.
To protect Personal Data, the Company may require appropriate identity verification before processing any request.
The Company shall review requests in accordance with applicable legal requirements and may request additional information where reasonably necessary to verify identity or clarify the request.
Where permitted by law, the Company may decline requests that are manifestly unfounded, excessive, repetitive, fraudulent, or otherwise not legally enforceable.
20. Personal Data Security Incidents
The Company maintains procedures designed to identify, investigate, contain, document, and respond to Personal Data security incidents.
Where a security incident involving Personal Data occurs, the Company may:
- Investigate the incident;
- Contain and mitigate its effects;
- Assess potential risks to affected individuals;
- Preserve relevant evidence;
- Implement corrective measures;
- Notify competent authorities where required by applicable law;
- Notify affected Data Subjects where legally required or where appropriate to reduce potential harm.
The Company continuously reviews security incidents to strengthen its information security framework and reduce the likelihood of future occurrences.
21. Cookies and Similar Technologies
The Company uses cookies and similar technologies to improve the functionality, performance, security, and user experience of the Platform.
Cookies are small text files stored on a user's device when visiting a website or using certain digital services. They enable the Platform to recognize devices, remember user preferences, improve performance, and enhance security.
The Company may also use technologies functionally similar to cookies, including software development kits (SDKs), local storage, pixels, tags, and similar tracking technologies, where permitted by applicable law.
21.1 Essential Cookies
Essential cookies are necessary for the proper operation of the Platform and cannot generally be disabled without affecting core functionality.
These cookies may be used for purposes including:
- User authentication;
- Session management;
- Security protection;
- Fraud prevention;
- Load balancing;
- Maintaining user preferences necessary for Platform operation.
21.2 Performance and Analytics Cookies
Performance technologies help the Company understand how users interact with the Platform.
Such information may include:
- Number of visitors;
- Frequently visited pages;
- Navigation paths;
- Error reports;
- Session duration;
- Platform performance metrics;
- Feature usage statistics.
Where practical, such information is aggregated or anonymized before analysis.
21.3 Functional Cookies
Functional cookies enable enhanced Platform functionality by remembering user preferences, including:
- Preferred language;
- Regional settings;
- Login preferences;
- Accessibility settings;
- User interface customization.
21.4 Advertising Technologies
Should the Company conduct digital marketing campaigns, advertising technologies may be used to:
- Measure campaign effectiveness;
- Prevent duplicate advertisements;
- Improve advertising relevance;
- Analyze promotional performance.
Where required by applicable law, appropriate consent mechanisms shall be implemented before such technologies are activated.
21.5 Cookie Management
Users may manage or disable cookies through their browser or device settings.
Disabling certain cookies may affect the availability, functionality, or performance of some Platform features.
22. Location Information
Because transportation and logistics services depend upon accurate geographical information, the Company processes location information as described below.
22.1 Customer Location Data
Location information relating to Customers may be processed to:
- Identify pickup locations;
- Identify delivery destinations;
- Calculate transportation distances;
- Estimate delivery times;
- Recommend nearby services;
- Improve address accuracy;
- Facilitate communication with Drivers.
22.2 Driver Location Data
During active transportation services, the Driver Application may collect location information, including while operating in the background where permitted by the device settings and applicable law.
Location information may be processed for purposes including:
- Route navigation;
- Shipment tracking;
- Dispatch management;
- Route optimization;
- Driver allocation;
- Safety monitoring;
- Proof of Delivery verification;
- Customer support;
- Investigation of operational disputes;
- Service quality improvement.
The Company does not process location information for purposes unrelated to transportation services unless permitted by applicable law or with the appropriate legal basis.
22.3 Location Permissions
Users may modify location permissions through their device settings.
However, disabling location services may prevent certain Platform functions from operating correctly and may affect the Company's ability to provide transportation services.
23. Communications and Notifications
The Company communicates with Users through various communication channels necessary for providing and supporting the services.
These communications may include:
- SMS messages;
- Email communications;
- Push notifications;
- In-application notifications;
- Telephone calls;
- Messaging applications where integrated into the Platform.
Service-related communications may include:
- Account verification;
- Order confirmation;
- Shipment status updates;
- Driver arrival notifications;
- Pickup confirmations;
- Delivery confirmations;
- Electronic invoices;
- Security alerts;
- Important operational announcements.
23.1 Marketing Communications
Subject to applicable law, the Company may send promotional communications regarding:
- New services;
- Promotional campaigns;
- Special offers;
- Customer surveys;
- Loyalty programs;
- Educational content relating to logistics services.
Where consent is required, marketing communications will only be sent after obtaining the necessary consent.
Recipients may unsubscribe from marketing communications at any time using the opt-out mechanisms provided.
Operational, security, regulatory, or contractual communications may continue to be sent where necessary.
24. Call Recording
The Company may record telephone conversations with Customer Support or operational service centers where permitted by applicable law.
Recordings may be used for purposes including:
- Quality assurance;
- Employee training;
- Complaint handling;
- Fraud prevention;
- Verification of customer instructions;
- Protection of legal rights;
- Regulatory compliance.
Where required by law, callers will be informed before call recording begins.
25. Photographs, Documents, and Supporting Evidence
The Company may collect photographs, scanned documents, or other supporting materials uploaded by Customers, Drivers, Transportation Companies, or authorized users.
Examples include:
- Shipment photographs;
- Pickup location photographs;
- Delivery location photographs;
- Vehicle photographs;
- Identity documents;
- Commercial documents;
- Proof of Delivery documentation;
- Damage reports.
Such materials are processed solely for legitimate operational, contractual, legal, security, and dispute-resolution purposes.
26. Analytics and Business Intelligence
The Company may analyze operational information to improve its services and business operations.
Such analysis may include:
- Shipment performance;
- Delivery efficiency;
- Customer satisfaction;
- Driver performance;
- Platform stability;
- Operational forecasting;
- Capacity planning;
- Service optimization.
Where practical, the Company uses aggregated, anonymized, or de-identified information for analytical purposes.
27. Automated Technologies and Artificial Intelligence
The Company may utilize automation technologies, machine learning, artificial intelligence, predictive analytics, or similar technologies to improve operational efficiency and customer experience.
Examples may include:
- Shipment allocation;
- Route optimization;
- Fraud detection;
- Customer service automation;
- Operational forecasting;
- Demand prediction;
- Service recommendations;
- Performance analytics.
The Company seeks to ensure that the use of such technologies remains consistent with applicable laws, respects individual rights, and incorporates appropriate human oversight where required.
Automated processing shall not be used to make decisions producing legal or similarly significant effects on individuals except where permitted by applicable law or supported by an appropriate legal basis.
28. Future Technologies
The Company continuously evaluates new technologies to enhance the Platform.
Where new technologies involve the processing of Personal Data, the Company shall assess applicable privacy risks and implement appropriate legal, technical, and organizational safeguards before deployment.
The Company reserves the right to introduce additional technologies provided that their implementation remains consistent with this Privacy Policy and applicable legal requirements.
29. Children's Privacy
The Platform is intended for individuals and legal entities that are legally capable of entering into binding agreements under the laws of the Kingdom of Saudi Arabia.
The Company does not knowingly collect Personal Data from children or other individuals who lack the legal capacity to contract unless such processing is permitted by applicable law and, where required, authorized by a parent, legal guardian, or other legally authorized representative.
If the Company becomes aware that Personal Data has been collected in violation of this provision, it will take appropriate steps to investigate the matter and, where appropriate, delete or otherwise lawfully dispose of such Personal Data.
Parents or legal guardians who believe that a child has provided Personal Data to the Company without proper authorization are encouraged to contact the Company using the contact details provided in this Privacy Policy.
30. Accuracy of Personal Data
Users are responsible for ensuring that the Personal Data they provide to the Company is accurate, complete, and up to date.
Users shall promptly notify the Company of any material changes affecting their Personal Data, including changes relating to:
- Contact information;
- Identity information;
- Billing information;
- Authorized representatives;
- Delivery addresses;
- Business information;
- Driver licensing information;
- Vehicle registration information.
The Company shall not be responsible for delays, service failures, additional costs, or other consequences resulting from inaccurate, incomplete, outdated, or misleading information provided by Users.
31. User Account Responsibilities
Users are solely responsible for maintaining the confidentiality of their account credentials, including passwords, verification codes, authentication methods, and any other security credentials associated with their accounts.
Users agree to:
- Keep login credentials confidential;
- Use strong passwords where applicable;
- Prevent unauthorized access to their accounts;
- Notify the Company immediately upon becoming aware of any unauthorized access or suspected compromise;
- Log out of shared devices after use;
- Cooperate with the Company during security investigations relating to their accounts.
The Company reserves the right to suspend or restrict access where it reasonably believes that account security has been compromised.
32. Third-Party Websites and Services
The Platform may contain links to third-party websites, applications, products, or services that are not owned or controlled by the Company.
Examples include:
- Payment service providers;
- Mapping services;
- Government digital services;
- Transportation partners;
- Insurance providers;
- Identity verification providers;
- Logistics partners;
- Communication platforms.
The Company does not control and is not responsible for the privacy practices, security measures, or content of third-party services.
Users are encouraged to review the privacy policies and terms applicable to any third-party services they access.
33. Changes to this Privacy Policy
The Company may amend, revise, or update this Privacy Policy from time to time in response to:
- Changes in applicable laws or regulations;
- New regulatory guidance;
- Operational developments;
- New products or services;
- Technological advancements;
- Security improvements;
- Changes in business practices.
The latest version published on the Platform shall constitute the governing version unless otherwise stated.
Where required by applicable law, Users will be notified of material changes through appropriate communication channels.
Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acknowledgement of the revised Policy to the extent permitted by applicable law.
34. Severability
If any provision of this Privacy Policy is determined by a court or competent authority to be unlawful, invalid, or unenforceable, such provision shall be interpreted to the maximum extent permitted by applicable law or, where necessary, deemed severed from this Privacy Policy.
The remaining provisions shall continue in full force and effect.
35. No Waiver
Any failure or delay by the Company to exercise any right, remedy, or provision under this Privacy Policy shall not constitute a waiver of such right.
No waiver shall be effective unless expressly made in writing by an authorized representative of the Company.
A waiver of any breach shall not constitute a waiver of any subsequent breach.
36. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL), its Implementing Regulations, and any other applicable legislation.
Nothing in this Privacy Policy shall be interpreted as limiting any rights granted to Data Subjects under mandatory applicable law.
37. Jurisdiction
Unless otherwise required by applicable law or agreed by the parties through a legally enforceable dispute resolution mechanism, any dispute arising out of or relating to this Privacy Policy shall be subject to the jurisdiction of the competent courts of the Kingdom of Saudi Arabia.
38. Contact Information
Questions, requests, complaints, or enquiries concerning this Privacy Policy or the processing of Personal Data may be directed to:
Transformation Logistics Company
Trade Name: Haulerz
Commercial Registration No.: 7017320214
Website: https://haulerz.com
Email: support@haulerz.com
Telephone: +966 920035830
The Company will review and respond to requests in accordance with applicable legal and regulatory requirements.
39. Effective Date
This Privacy Policy becomes effective on the date of its publication on the Platform unless another effective date is expressly specified.
The Company reserves the right to replace this Privacy Policy with updated versions from time to time.
40. User Acknowledgement
By accessing or using the Platform, creating an account, requesting transportation services, or otherwise interacting with the Company, you acknowledge and agree that:
- You have read and understood this Privacy Policy;
- You understand how the Company processes Personal Data;
- You consent to the processing of Personal Data where consent is the applicable legal basis;
- You acknowledge that certain processing activities are necessary for the performance of contractual obligations or compliance with applicable law;
- You agree to provide accurate and up-to-date information;
- You understand your rights regarding Personal Data under applicable law.
This Privacy Policy forms an integral part of the legal framework governing the use of the Company's Platform and services.