Privacy Policy

1.Scope of this policy

This policy applies to:

• the TransferArc Driver app (shown on phones as “tARC Driver”), for drivers;
• the TransferArc app, for agents and customers who book transfers;
• the TransferArc Owner app (shown on phones as “tARC Owner”), for company owners and staff;
• the TransferArc web panel at apps.transferarc.com, including the platform administration area;
• the TransferArc programming interface (API) and the notifications, emails and documents sent through the platform.

It does not apply to websites or services run by others, even when they are linked from TransferArc, or to how a transport company uses information outside TransferArc. Those are governed by their own privacy notices.

2.Who we are and our role

TransferArc is operated by Innovate Solution Global Pte. Ltd., a company in Singapore (“we”, “us”, “our”):

101 Kitchener Road, #03-02 Jalan Besar Plaza, Singapore 208511
Privacy requests: privacy@transferarc.com
Legal notices: legal@innovatesolution.com

Two roles

• On behalf of transport companies. Each transport company that uses TransferArc (a “company” or “tenant”) decides what information about its staff, drivers, vehicles, agents, customers and passengers is entered into its account and how it is used. For that information the company is responsible for it (it is the “controller” or, in Singapore terms, the “organisation”), and we process it on the company's behalf and on its instructions (as a “processor” or “data intermediary”).
• For our own purposes. We are responsible for the information we use to run, secure and support the platform itself — for example sign-in security records, platform administration, our dealings with companies that subscribe to TransferArc, and requests sent to us directly.

Where a company is responsible, its own privacy notice also applies, and we will pass requests we receive about its information to it and support it in answering them.

3.Summary

• We use personal information to provide the transport service: signing in, bookings, trips, dispatch, notifications, invoicing, settlement, safety and support.
• Drivers' precise location is collected only while one of their trips is running, and positions are deleted after 90 days.
• The apps contain no advertising and no analytics or tracking software. We do not sell personal information and do not use it for advertising.
• Information is shared with the transport company concerned, with the service providers that run the platform for us, and with authorities where the law requires it.
• You can ask to access, correct or delete your information, and to have your account deleted — see “Your rights” and the account deletion page.

4.Information we process

What is processed depends on how you use TransferArc and what the transport company records. The categories are:

Account and profile

Username, full name (and, where the company records it, the name in Arabic), email address, phone number, user type and role, the company and branch you belong to, language and display preferences, profile photo if one is added, and a password — which we store only in a one-way protected form (Argon2id hashing), never as readable text.

Customers, agents and passengers

For business customers and agents: company or account name, contact person, email, phone, billing address, tax registration number where relevant, credit terms, deposits and account balance. For bookings: the lead passenger's name and phone, the names of other passengers where provided, number of passengers and luggage, flight numbers and times, pickup and drop-off places, notes for the driver, and the customer's own reference.

Drivers

Name (including in Arabic where recorded), phone, email, nationality, date of birth, employee code, engagement (employee or vendor driver), branch and driver pool, assigned vehicle, pay terms, earnings, cash collected and wallet balance, ratings given to trips, compliance status and the documents the company records for compliance (for example licences and permits, with their numbers, dates and images), photo, fuel and expense entries with receipts, vehicle problem reports, messages sent by the company, SOS alerts and the sign-in devices of the driver app.

Vehicles

Plate number, make, model, year, colour, class, seats and luggage capacity, ownership or supplying vendor, odometer readings, fuel profile and fuel cards, maintenance records and job cards, documents and photos. Vehicle records are business records, but they can relate to an identifiable driver while a vehicle is assigned to one.

Bookings, trips and dispatch

Booking references, service type, routes, scheduled and actual times, prices, extras, status changes (assigned, on the way, arrived, picked up, completed, cancelled), the driver and vehicle assigned, who made each change and when, cancellation reasons, flight updates and trip ratings.

Location (driver app only)

Precise position, accuracy, speed, heading and time, collected only while a driver's trip is in progress. See “Location information” below.

Photos, documents and uploaded files

Files you or the company choose to upload: profile and vehicle photos, document images, fuel and expense receipts, vehicle problem photos, company logos and bank statement files imported for reconciliation. The apps open the phone's camera or photo picker only when you choose to attach a file, and read only the file you pick.

Messages, notifications and communications

Notifications shown in the web panel and apps, messages a company sends to its drivers, emails sent through the platform (such as booking confirmations, invoices, invitations and password links) and their delivery status, and the correspondence you send us.

Payments, invoices and financial records

TransferArc does not process card payments and has no payment gateway: payments are made by bank transfer or cash and are recorded by the company. We process the records of those payments — invoices, credit and debit notes, receipts, deposits, refunds, bank account details the company records for payments, bank statement lines, cash counts, journal entries and tax (VAT) records. Where a company switches on Saudi e-invoicing, invoice data is also prepared for and sent to the tax authority (ZATCA).

Device and technical information

A random identifier created by the app or browser for each installation, the device name the app reports (for example “TransferArc app (android)”), the app's platform and version, the push notification token, the sign-in session (start time, last use, end and its reason), and the IP address of requests, which we use for security, sign-in throttling and audit records.

Usage, security and audit records

Records of important actions in a company's account — who changed what and when — sign-in attempts, requests made through the API with API keys, and the delivery records of emails and push notifications. We do not use analytics tools to profile how you use the apps.

Information from others

Most information about you is entered by the transport company you work with or book with, by its staff, or by an agent or corporate account booking on your behalf. Some information comes from services the company connects: for example address search results from a maps provider, responses from the tax authority for e-invoices, and bookings received from a partner's system through the API.

5.How we use information and why

We use personal information only for the purposes below. Where the law requires a legal basis, the basis is shown; when we act for a transport company, the company determines the basis for its own use.

We do not use personal information for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Suggestions the platform makes — such as a recommended vehicle class or a suggested driver for a trip — are aids for the company's staff, who make the decision.

6.Location information

• Who: only the TransferArc Driver app collects location. The TransferArc and TransferArc Owner apps and the web panel do not read the location of the device they run on; they only display a driver's position during a trip.
• What: precise location — position, accuracy, speed, heading and time.
• When: only while one of the driver's trips is in progress (on the way to the pickup, at the pickup and during the trip), including when the app is in the background or the screen is off. Sharing starts with the driver's own action in the app and stops when the trip ends. Location is not collected outside trips.
• How you are told: the app explains the use of location before the phone asks for permission. While location is shared, Android shows a “trip in progress” notification, iOS shows its location indicator and the app shows “Sharing location”.
• Why and who sees it: so the company can follow the trip (live map, route, arrival estimate, alerts if a vehicle stops or loses signal) and so the app can tell the driver when they reach the pickup area. The customer, or whoever booked, sees the driver's latest position and arrival estimate while the trip runs — not the route.
• SOS: when a driver raises an SOS, the position at that moment is sent to the company with the alert.
• Retention: positions are deleted automatically 90 days after they are recorded.
• Your choice: location permission can be refused or withdrawn at any time in the phone's settings or from the app's “App permissions” page. Trips can still be worked without it, although the company may need location for your work.

7.Push notifications and messages

The apps can send push notifications — for example a new or changed trip, a message from the company, a booking update or an SOS. Push notifications are delivered by Firebase Cloud Messaging, a service of Google. To deliver them, the app registers a notification token for your signed-in session. The token is removed when you sign out, when the session ends (for example when a driver signs in on another phone) and when it has not been used for 60 days.

You can switch notifications off at any time in the phone's settings or from the app's “App permissions” page; in the web panel, browser notifications are off until you switch them on. Messages from a company to its drivers are one-way service messages: drivers read them in the app and cannot reply through TransferArc.

The apps do not send marketing notifications.

8.Cookies and similar technologies

TransferArc uses only what is needed to sign you in and remember your settings. We do not use advertising, analytics or cross-site tracking cookies, and these policy pages set no cookies.

Because these are strictly necessary for the service, they cannot be switched off without stopping sign-in from working. You can clear them at any time in your browser or by signing out.

9.How information is shared

We share personal information only as follows:

App stores (Google Play and the Apple App Store) process information when you download and update the apps under their own privacy policies.

10.International transfers

We are based in Singapore, our service providers operate in several countries, and transport companies and their users may be in other countries, including Saudi Arabia. Personal information may therefore be stored or processed outside the country where you live.

When we transfer personal information across borders, we take the steps that the applicable data protection law requires for such transfers, such as contractual protections with recipients, and we require our service providers to protect it to a comparable standard.

11.How long information is kept

We keep personal information only as long as it is needed for the purposes above, for the period the transport company requires within its account, or as the law requires. Then it is deleted or anonymised.

When a transport company stops using TransferArc, its account information is deleted or returned to it in line with our agreement with that company and the law.

12.How information is protected

We use technical and organisational measures appropriate to the risk, including:

• encrypted connections (HTTPS) between the apps, browsers and our servers;
• passwords stored only as Argon2id hashes, and sign-in tokens stored only in protected form;
• separation of each company's information at database level and access limited by role, permission and branch;
• sign-in throttling and lockout against password guessing, short-lived access tokens and one active phone per driver;
• audit records of important changes;
• encrypted backups and encrypted storage of service credentials;
• on phones, the sign-in session is kept in the device's secure storage and excluded from cloud backups.

No system can be guaranteed to be completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where the law requires it. Please keep your password private and tell your company or us at once if you think your account has been misused.

13.Your rights

Depending on the law that applies to you, you may have the right to:

• access the personal information held about you and receive a copy;
• correct information that is inaccurate or incomplete;
• delete your information and have your account deleted — see the account deletion page;
• export information you provided in a structured, commonly used format (data portability);
• restrict or object to certain processing, including processing based on legitimate interests;
• withdraw consent where processing is based on consent, such as location or notification permissions, without affecting processing before withdrawal;
• complain to a data protection authority.

How to make a request

Email privacy@transferarc.com from the email address on your account, or ask the transport company you work with or book with. Tell us your username, the company's name and what you are asking for. We may ask you to confirm your identity before acting, and we will not charge a fee unless the law allows it for unfounded or excessive requests.

Where the transport company is responsible for the information, we forward your request to it promptly and help it respond. We answer requests within the time the applicable law sets.

Region-specific information

• Saudi Arabia: where the Personal Data Protection Law applies, you have the rights it provides, including to be informed, to access, to correct and to request destruction of your personal data, and to complain to the competent authority.
• Singapore: where the Personal Data Protection Act applies, you may request access to and correction of your personal data and withdraw consent, and you may complain to the Personal Data Protection Commission.
• European Economic Area and United Kingdom: where the GDPR or UK GDPR applies, you have the rights listed above and may complain to your local supervisory authority.
• California: where the CCPA/CPRA applies, you may request to know, delete and correct personal information and you will not be discriminated against for doing so. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that would require an opt-out.

14.Your choices

• Permissions: location, notifications and camera or photo access can be allowed or refused in the phone's settings; the driver app's “App permissions” page shows each one, why it is used and how to change it.
• Notifications: push notifications can be switched off on the phone; browser notifications in the web panel are off until you switch them on. Some service emails, such as password links and invoices, are needed to provide the service.
• Marketing: the apps and the platform do not send marketing messages. If we ever offer them, we will ask for any consent the law requires and every message will include a way to opt out.

15.Children

TransferArc is a business service for transport companies, their staff and drivers, agents and customers. The apps and accounts are not intended for anyone under 18, and we do not knowingly create accounts for children.

A booking may name a passenger who is a minor, for example a family member travelling with an adult. Such details are entered by the person or company making the booking, who is responsible for having the authority to provide them, and they are used only to carry out the trip. If you believe a child's information has been provided to us inappropriately, contact us and we will take appropriate steps, including deletion.

16.Account termination and deletion

You can ask for your account and personal information to be deleted at any time. How to do it, what is deleted, what must be kept and for how long are explained on the account deletion page.

A transport company can also suspend or close the accounts it created, for example when someone leaves. Suspending an account signs it out on every device at once.

17.Business transfers

If we are involved in a merger, acquisition, restructuring, financing or sale of all or part of our business or assets, personal information may be transferred to the parties involved, under confidentiality, as part of that transaction. The recipient will be required to handle it in line with this policy and the law, and we will notify you where the law requires it.

18.Changes to this policy

We may update this policy as TransferArc and the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell users in the apps or web panel, or by email, before they take effect where the law requires it.

19.Contact us

For questions or requests about privacy:

• Email: privacy@transferarc.com
• Legal notices: legal@innovatesolution.com
• Post: Innovate Solution Global Pte. Ltd., 101 Kitchener Road, #03-02 Jalan Besar Plaza, Singapore 208511

This policy is available in English, Arabic, Bangla and Urdu. All versions have the same content; if there is any difference in meaning, the English version prevails.