FleetOS Privacy Policy — Qatar

Version: 5.7.2 Effective date: August 20, 2026 Market: Qatar

1. Who controls your information

The Local FleetOS Entity displayed to you at account creation and recorded in your acceptance evidence is the controller of your personal information for account administration, platform security, fraud prevention, billing, analytics and legal compliance in that market. “FleetOS” in this Policy means that Local FleetOS Entity only, unless a specific recipient is separately identified.

For an Operator Network Ride, each Office is a separate and independent controller for its own transportation operations: managing its Drivers, setting its fares, handling complaints, meeting regulatory obligations, and using information it collects independently of FleetOS. Information necessary for that Ride is shared with the Office and its own privacy notice governs its independent use. For an activated FleetOS Direct Ride, the Local FleetOS Entity acts as controller for the Direct transportation operation, including its own direct-driver administration, fare, safety, compliance and complaint handling.

FleetOS acts as a processor on behalf of an Office only where the Data Processing Addendum (FOS-07) expressly applies — broadly, when we handle information at the Office's instruction for the Office's own purposes.

Market data ring-fencing. FleetOS market entities are not joint controllers merely because they use the same brand, software or ownership structure. Personal information is assigned to the market tenant for your Local FleetOS Entity. Another market entity may access or receive it only where this Policy identifies a lawful recipient role, FOS-07 lists it as a subprocessor for Office-controlled data, or law otherwise requires the transfer.

Separate requests and records. A privacy, litigation, regulatory or law-enforcement request directed to one FleetOS market entity does not by itself authorise another market entity to search, disclose or act on records controlled by the Local FleetOS Entity. Requests are routed to the entity that controls the relevant records, unless applicable law requires a different response.

2. What we collect and why

3. How we use information

We use personal information to provide and operate the Platform Services; to authenticate and secure accounts; to match Passengers with Offices and Drivers; to calculate and process payment; to communicate with you about your account, bookings and safety; to detect, investigate and prevent fraud, abuse and security incidents; to comply with legal, regulatory, tax and sanctions obligations; to investigate safety incidents and respond to lawful requests; to improve and develop the Platform Services; and to produce aggregated or de-identified analytics.

4. Automated processing and profiling

We use automated systems for fraud scoring, security risk assessment, dispatch matching and objective document-expiry gating.

We do not make solely automated decisions that produce legal or similarly significant effects on you without human involvement, except for objective document-expiry gates, which are mechanical (a document has expired or it has not) and are reversed immediately when the document is renewed.

We do not make hiring, engagement or termination decisions for an Office. If FleetOS Direct is activated, the Local FleetOS Entity may make decisions concerning its own Direct Drivers under a separate engagement process and applicable employment/contractor, background-screening and transport law. Where an automated control materially restricts Platform access, you may request human review under FOS-01 §17 where required and, in practice, where you ask.

5. Who we share information with

We do not sell your personal information for money. Any additional privacy rights or restrictions applicable in this market are set out in the country Annex below.

6. Location information

Location is central to how the Platform Services work, so we treat it with particular care.

Passengers. We collect precise location when the app is in use to set pickup, match you with a nearby vehicle, navigate, calculate fare and support safety features. You may grant location permission while using the app only. If you deny location permission you can still enter addresses manually, but matching quality and safety features will be reduced.

Drivers. We collect precise location while you are online in Fleet DriverX, and for a short period after a trip ends for fare, dispute and safety purposes. Background location is collected while you are online so that dispatch and safety features work when the app is not in the foreground. We do not collect your location when you are offline in the app.

You can change or withdraw location permission at any time in your device settings. Doing so will disable the features that depend on it.

Detailed precise trip location is ordinarily retained for 12 months and is then aggregated or deleted. A specific record may be retained longer only for an open claim, safety investigation, fraud investigation, insurance matter, legal hold, regulatory obligation, tax/accounting requirement that applies to that record, or other documented legal necessity.

7. Identity verification and biometric information

At launch, FleetOS may collect ID documents and document images and may use an approved verification provider to return a verification result. FleetOS does not create or retain a facial-recognition, fingerprint, voiceprint or other biometric identifier/template at launch. Ordinary photographs and copies of identity documents are not treated by FleetOS as biometric templates merely because they contain a face. If a future feature creates or uses biometric identifiers, that feature must remain disabled until the relevant market notice, consent, retention/destruction schedule, vendor assessment and applicable legal review and approval have been completed.

Where we or an Office use identity verification that involves a facial scan or similar biometric process, we will tell you before it happens, tell you what is collected, tell you who processes it and for how long, and obtain your separate written consent. You are not required to consent; if you decline, an alternative verification route will be offered where one exists, and where none exists the affected function will be unavailable.

Biometric identifiers are not sold, leased, traded or otherwise profited from. They are retained only as long as necessary for the verification purpose and are deleted no later than the earlier of the satisfaction of that purpose or the deadline set by applicable law. Any market-specific restrictions are set out in the country Annex below.

8. How long we keep information

The Data Retention Register (FOS-07 Schedule 3) is the authoritative source. The table below is a summary and is subject to local law, legal holds and open disputes.

9. Your rights

Depending on where you are, you may have the right to: access the information we hold about you; correct inaccurate information; delete information; obtain a portable copy; restrict or object to certain processing; withdraw consent; opt out of certain sharing or targeted advertising; and appeal a decision we make on your request.

Submit requests through the Privacy Request form in the FleetOS Legal Center, or at the Privacy Request channel in the FleetOS Legal Center. We verify requests proportionately to the sensitivity of the information — we will ask you to confirm control of the account, and for high-risk requests we may ask for more.

We respond within the period applicable law requires, and in any event without undue delay. If we decline a request we will tell you why and how to appeal or complain.

Requests to an Office. Where an Office is the controller — for its own operations, its own Driver management, or its own complaint records — direct your request to that Office. We will help you identify the right contact.

10. Deletion and what survives it

When you delete your account we delete or de-identify your personal information, except where we must retain it to: comply with a legal, tax, accounting or regulatory obligation; resolve a dispute or defend a claim; complete a payment, refund or chargeback; enforce our agreements; prevent fraud or abuse; or preserve evidence under a legal hold.

Backups are overwritten on our ordinary backup cycle. Aggregated and de-identified information that cannot be linked back to you is not deleted.

11. Law enforcement and government requests

We disclose personal information to authorities only where the Local FleetOS Entity that controls the records is compelled by valid legal process, or where that entity reasonably believes in good faith that disclosure is necessary to prevent imminent death or serious physical harm. Another FleetOS market entity does not become a records custodian merely because it shares branding or technology.

We require legal process appropriate to the request. We review each request for validity, scope and proportionality, and we push back on requests that are overbroad, defective or unlawful. Where we are legally permitted to do so, we notify the affected user before disclosing, unless doing so would create a risk of harm or obstruct an investigation.

We intend to publish a periodic transparency report on request volumes once operational volumes make one meaningful.

12. Cookies and similar technologies

We use strictly necessary cookies to operate the website and keep it secure; these cannot be disabled. We use functional, analytics and — where enabled — advertising cookies only with your consent where consent is required.

You can manage your choices in the cookie preference centre on our website, or in your browser settings. Withdrawing consent does not affect the lawfulness of prior processing. See Annex B for Qatar-specific rules.

13. Marketing

We send marketing only where you have opted in, or where applicable law permits us to contact an existing customer about similar services and you have not opted out.

Every marketing message contains an unsubscribe mechanism. You can also manage marketing preferences in your account settings. Opting out of marketing does not stop service, security, transactional, safety or legal messages, which you receive as long as you hold an account.

Where an Office markets to you, that Office is the sender and is responsible for its own compliance. We do not provide your contact details to an Office for its independent marketing without your consent.

Advertising and measurement technologies. Where enabled for a market and only after any consent required by applicable law, FleetOS may use Google Analytics and may use advertising/measurement technologies such as Google Ads, Meta and TikTok to measure campaigns, attribute conversions, limit frequency and deliver or measure advertising. These tools are non-essential. We provide consent/choice controls where required, and in the United States we honour applicable opt-out preference signals such as Global Privacy Control as described in Annex A. Advertising vendors do not receive Office-controlled data merely because the Office uses FleetOS.

14. Background screening

Some markets require, and some Offices lawfully conduct, background or driving-record checks on Drivers. Where such a check is performed in the United States through a consumer reporting agency, it is subject to the Fair Credit Reporting Act, and you will receive a standalone written disclosure and provide written authorisation before it happens, and will receive pre-adverse and adverse action notices with a copy of the report and a summary of your rights before any adverse decision becomes final.

For an Office-affiliated Driver, the Office, not FleetOS, is the decision-maker. We may transmit a result and record a status; we do not decide whether the Office engages the Driver. For a FleetOS Direct Driver, the Local FleetOS Entity may be the decision-maker only under its separate Direct-driver process and must follow applicable background-screening, adverse-action, transport and worker-classification law.

15. Children and minor passengers

The Platform Services are not directed to children, and a person below the minimum account age in FOS-01 §3.2 may not create a FleetOS account. An adult account holder may, however, provide limited information about a minor passenger when lawfully arranging transportation for that minor through a transportation provider that expressly offers such service. That information may include the minor passenger's name or identifier, pickup and destination information, trip location or status, guardian contact details, and safety information reasonably necessary for the Ride.

FleetOS uses minor-passenger information only for the lawful Ride, safety, support, legal-compliance and recordkeeping purposes described in this Policy, applies heightened data-minimisation and access controls, and does not use known minor-passenger data for behavioural advertising. If FleetOS learns that a minor created an account contrary to FOS-01, FleetOS will disable the account and handle the information in accordance with applicable law. Where market-specific child-data or parental-consent rules apply, FleetOS will obtain the legally required consent or authorisation, rely on a lawful exception, or will not undertake the processing. A parent or guardian may contact the Privacy Request channel in the FleetOS Legal Center regarding a minor's information.

16. Security

We maintain technical and organisational measures described in FOS-06 Schedule 3, including encryption in transit and at rest, access control on a least-privilege basis, multi-factor authentication for administrative access, logging and monitoring, vulnerability management, and personnel training.

No system is perfectly secure. If a personal data breach occurs, we notify affected individuals and regulators within the period applicable law requires, and we notify Offices within the contractual period in FOS-07 §7.

17. Where information is processed

Personal information may be processed outside your country by approved cloud providers and subprocessors. The current hosting locations, subprocessors and transfer safeguards are published in FOS-07 Schedule 2. Other FleetOS market entities are not default recipients or processors; if one performs a service involving personal information, it must be specifically documented with its role, purpose, access scope and transfer basis.

Where information is transferred out of a jurisdiction that restricts transfers, we rely on the mechanism identified in that Register — such as standard contractual clauses, an adequacy decision, or your explicit consent where permitted. A market is not activated until its data-location and transfer assessment is completed and recorded.

18. Changes to this Policy

We will post changes here with a new effective date. Where a change materially affects how we use your personal information, we give you conspicuous notice and, where the law requires it or where the change is material, we ask for your renewed consent.

19. Contact and complaints

Qatar public contacts: Legal/support: info@fleetapp.net · Privacy: privacy@fleetapp.net · Legal Center: https://fleetapp.net/#legal. No public telephone support number is designated for this market.

Contact us at the market-specific privacy contact details shown in the FleetOS Legal Center. Our data protection contact is the Data Protection Lead identified in the FleetOS Legal Center.

If you are not satisfied with our response, you may complain to the supervisory authority or other competent complaint body identified for your market in the relevant Annex or the FleetOS Legal Center. Where no dedicated privacy authority is available for the relevant issue, the Legal Center identifies the applicable general complaint route.

Annex B — Qatar

B1. Scope and controlling law

This Annex applies where the Platform Services are offered in Qatar or a Ride begins in Qatar. Processing is subject to Law No. 13 of 2016 concerning Personal Data Privacy Protection and its implementing decisions and guidelines, as administered by the competent authority. The controller is Fleet O S Technology & Software L.L.C.

B2. Language

This Policy is published in Arabic and English. The Arabic text controls to the extent required by Qatari law or public order. See FOS-05 Part B.

B3. Legal grounds

We process personal data where processing is necessary to achieve a lawful purpose of the controller or of the individual, on the basis of consent where consent is required, or where processing is required to comply with a legal obligation or a request from a competent authority.

B4. Data of a special nature

Data relating to ethnic origin, health, religious belief, marital relations and criminal records may be treated as data of a special nature under Qatari law and may require permission from the competent authority before processing. FleetOS therefore applies a data-minimisation model.

For an Office-affiliated Driver, the Office should retain the underlying medical-fitness certificate, criminal-record/background document or other special-nature source record where the Office is legally responsible for obtaining it. FleetOS ordinarily receives only a verification status, category, issue/expiry date and other minimum eligibility information necessary to administer platform access. The Office remains responsible for its own lawful collection and retention of the source document.

FleetOS does not receive or store the underlying special-nature source record in Qatar unless a documented legal basis and any required competent-authority permission permit that processing. For a FleetOS Direct Driver, if the Qatar Local FleetOS Entity is legally required to obtain or process such information itself, it will do so only after the required permission, notices, access controls, retention rules and other safeguards have been established. No contractual request for a Driver document authorises unlawful special-nature processing.

B5. Individual rights

Individuals in Qatar may object to processing, request erasure where processing is no longer necessary for the purpose, request correction, request access, and withdraw consent. Requests are made through the channel in §9 and are answered in Arabic where the request is made in Arabic.

B6. Direct marketing

Direct electronic communications require prior consent, must identify the sender, and must offer a clear means to withdraw. Consent records are retained as set out in §8.

B7. Cross-border transfer

Transfer of personal data outside Qatar requires that the transfer does not prejudice the protection of the data and complies with applicable requirements. The hosting location and transfer basis for Qatar must be recorded in FOS-07 Schedule 2 before Qatar is activated.

B8. Breach notification

We notify the competent authority and affected individuals of a personal data breach in accordance with Qatari law and within the timescales it specifies.

B9. Regulator

The competent privacy authority is the National Cyber Security Agency’s National Data Privacy Office / Personal Data Privacy Protection function. Complaints and privacy-law enquiries may be submitted through the channels published by NCSA, including privacy@ncsa.gov.qa. FleetOS will keep the Legal Center contact details current before and during Qatar operations.