Lugmety Privacy Policy

Features

About

Partner with Us

Ride with us

Download App

Features

About

Partner with Us

Ride with us

Download App

Features

About

Partner with Us

Ride with us

Download App

Home

Features

About

Partner with us

Download App

Driver Privacy policy

1. Who we are (Data Controller)

Controller: Sahm AlMustaqbal Company For Information Technology (“Lugmety”, “we”, “us”), commercial

registration number 4030286232, registered at 4212 Al Rawdhah - Ar Rawdah Dist., Jeddah, Kingdom of

Saudi Arabia.

We are the controller of the personal data of drivers ("you") who register for and use the App. Where the App

handles data about our customers and vendors, we act as controller and you handle that data on our behalf

and under our instructions (see Section 12).

Controller: Sahm AlMustaqbal Company For Information Technology (“Lugmety”, “we”, “us”), commercial

registration number 4030286232, registered at 4212 Al Rawdhah - Ar Rawdah Dist., Jeddah, Kingdom of

Saudi Arabia.

We are the controller of the personal data of drivers ("you") who register for and use the App. Where the App

handles data about our customers and vendors, we act as controller and you handle that data on our behalf

and under our instructions (see Section 12).

Controller: Sahm AlMustaqbal Company For Information Technology (“Lugmety”, “we”, “us”), commercial

registration number 4030286232, registered at 4212 Al Rawdhah - Ar Rawdah Dist., Jeddah, Kingdom of

Saudi Arabia.

We are the controller of the personal data of drivers ("you") who register for and use the App. Where the App

handles data about our customers and vendors, we act as controller and you handle that data on our behalf

and under our instructions (see Section 12).

2. Scope of this policy

This policy applies to personal data we process about drivers ("delivery captains") in connection with

registration, onboarding, and use of the App to receive, accept, and fulfil delivery orders. It does not cover the separate privacy notice provided to Lugmety customers, or third-party services you may choose to use.

This policy applies to personal data we process about drivers ("delivery captains") in connection with

3. Personal data we collect

Depending on how you use the App, we collect the following categories of personal data:

3.1 Identity and account data

• Full name, profile photograph, date of birth, gender, and nationality.

• National ID / Iqama (residency) number and, where required, a copy of your ID, driving licence, and

right-to-work documentation. Government identifiers are treated as sensitive data under the PDPL and

handled with additional safeguards.

• Vehicle details (type, plate, registration) where relevant to your delivery role.

3.2 Contact data

• Mobile phone number, email address, and postal/residential address.

3.3 Location data

• Precise (GPS) location. The App collects your device’s precise location to assign nearby orders, enable

navigation, share live delivery status with customers and vendors, and verify deliveries.

• Background location. While you are on-duty/online, the App collects location in the background (even

when the App is not open) so orders can be dispatched and tracked. You control this through the on-

duty toggle and your device permissions; disabling it prevents you from receiving orders.

3.4 Device and technical data

• Device identifiers, advertising ID, IP address, device model, operating-system version, App version,

language, mobile network, and push-notification tokens.

• Diagnostics and crash data collected via Firebase Crashlytics and Analytics (e.g. crash logs, performance

and usage events) to keep the App reliable and secure.

• Device-integrity and anti-fraud signals, for example whether the device appears to be rooted/tampered,

running on an emulator, or using a mock/false GPS location, collected to detect and prevent fraud (see

Section 5).

3.5 Order, performance and financial data

• Orders assigned, accepted, rejected, and completed; delivery timestamps and routes; ratings,

experience points ("XP"), and performance metrics; order history.

• Earnings, incentives, and payout information; records of cash collected from or on behalf of customers

("collections"), settlements, and related transaction history.

3.6 Customer and vendor data you access

• To perform a delivery you are shown limited customer and vendor data — for example customer name,

delivery address, and contact number, and order contents. Lugmety is the controller of this data; you

may use it only to complete the assigned delivery (see Section 12).

3.7 Media and communications

• Photographs you capture in the App as proof of delivery or handover, and images/documents you

upload during onboarding.

• Your communications with us and with customers/vendors made through or in connection with the App

(e.g. support messages, in-app or notification content, and messages sent via linked channels such as

Telegram where you choose to use them)

Depending on how you use the App, we collect the following categories of personal data:

3.1 Identity and account data

• Full name, profile photograph, date of birth, gender, and nationality.

• National ID / Iqama (residency) number and, where required, a copy of your ID, driving licence, and

right-to-work documentation. Government identifiers are treated as sensitive data under the PDPL and

handled with additional safeguards.

• Vehicle details (type, plate, registration) where relevant to your delivery role.

3.2 Contact data

• Mobile phone number, email address, and postal/residential address.

3.3 Location data

• Precise (GPS) location. The App collects your device’s precise location to assign nearby orders, enable

navigation, share live delivery status with customers and vendors, and verify deliveries.

• Background location. While you are on-duty/online, the App collects location in the background (even

when the App is not open) so orders can be dispatched and tracked. You control this through the on-

duty toggle and your device permissions; disabling it prevents you from receiving orders.

3.4 Device and technical data

• Device identifiers, advertising ID, IP address, device model, operating-system version, App version,

language, mobile network, and push-notification tokens.

• Diagnostics and crash data collected via Firebase Crashlytics and Analytics (e.g. crash logs, performance

and usage events) to keep the App reliable and secure.

• Device-integrity and anti-fraud signals, for example whether the device appears to be rooted/tampered,

running on an emulator, or using a mock/false GPS location, collected to detect and prevent fraud (see

Section 5).

3.5 Order, performance and financial data

• Orders assigned, accepted, rejected, and completed; delivery timestamps and routes; ratings,

experience points ("XP"), and performance metrics; order history.

• Earnings, incentives, and payout information; records of cash collected from or on behalf of customers

("collections"), settlements, and related transaction history.

3.6 Customer and vendor data you access

• To perform a delivery you are shown limited customer and vendor data — for example customer name,

delivery address, and contact number, and order contents. Lugmety is the controller of this data; you

may use it only to complete the assigned delivery (see Section 12).

3.7 Media and communications

• Photographs you capture in the App as proof of delivery or handover, and images/documents you

upload during onboarding.

• Your communications with us and with customers/vendors made through or in connection with the App

(e.g. support messages, in-app or notification content, and messages sent via linked channels such as

Telegram where you choose to use them)

Depending on how you use the App, we collect the following categories of personal data:

3.1 Identity and account data

• Full name, profile photograph, date of birth, gender, and nationality.

• National ID / Iqama (residency) number and, where required, a copy of your ID, driving licence, and

right-to-work documentation. Government identifiers are treated as sensitive data under the PDPL and

handled with additional safeguards.

• Vehicle details (type, plate, registration) where relevant to your delivery role.

3.2 Contact data

• Mobile phone number, email address, and postal/residential address.

3.3 Location data

• Precise (GPS) location. The App collects your device’s precise location to assign nearby orders, enable

navigation, share live delivery status with customers and vendors, and verify deliveries.

• Background location. While you are on-duty/online, the App collects location in the background (even

when the App is not open) so orders can be dispatched and tracked. You control this through the on-

duty toggle and your device permissions; disabling it prevents you from receiving orders.

3.4 Device and technical data

• Device identifiers, advertising ID, IP address, device model, operating-system version, App version,

language, mobile network, and push-notification tokens.

• Diagnostics and crash data collected via Firebase Crashlytics and Analytics (e.g. crash logs, performance

and usage events) to keep the App reliable and secure.

• Device-integrity and anti-fraud signals, for example whether the device appears to be rooted/tampered,

running on an emulator, or using a mock/false GPS location, collected to detect and prevent fraud (see

Section 5).

3.5 Order, performance and financial data

• Orders assigned, accepted, rejected, and completed; delivery timestamps and routes; ratings,

experience points ("XP"), and performance metrics; order history.

• Earnings, incentives, and payout information; records of cash collected from or on behalf of customers

("collections"), settlements, and related transaction history.

3.6 Customer and vendor data you access

• To perform a delivery you are shown limited customer and vendor data — for example customer name,

delivery address, and contact number, and order contents. Lugmety is the controller of this data; you

may use it only to complete the assigned delivery (see Section 12).

3.7 Media and communications

• Photographs you capture in the App as proof of delivery or handover, and images/documents you

upload during onboarding.

• Your communications with us and with customers/vendors made through or in connection with the App

(e.g. support messages, in-app or notification content, and messages sent via linked channels such as

Telegram where you choose to use them)

4. How we collect your data

• Directly from you — when you register, complete onboarding, update your profile, or contact support.

• Automatically — through your use of the App (location, device, diagnostics, and usage data), using

SDKs such as Google/Firebase and Google Play Services.

• From third parties — for example identity/right-to-work verification providers, our vendors and payment

partners, and Lugmety’s dispatch systems.

• Directly from you — when you register, complete onboarding, update your profile, or contact support.

• Automatically — through your use of the App (location, device, diagnostics, and usage data), using

SDKs such as Google/Firebase and Google Play Services.

• From third parties — for example identity/right-to-work verification providers, our vendors and payment

partners, and Lugmety’s dispatch systems.

5. Why we use your data and our legal basis (PDPL)

Under the PDPL we process personal data only where we have a lawful basis. We rely on the bases below:

• Performance of a contract / the driver relationship with you — to register and verify you, assign and

manage deliveries, calculate earnings and collections, provide support, and operate the App.

• Compliance with a legal obligation — tax, labour, transport, anti-fraud, and record-keeping obligations,

and responding to lawful requests from competent authorities.

• Legitimate interests / operation of our service — to secure the platform, prevent fraud (including

detecting rooted devices and GPS spoofing), improve reliability, and protect our users and business,

balanced against your rights.

• Your consent — for precise and background location collection, push notifications, and any optional

processing. You may withdraw consent at any time (Section 10); withdrawal does not affect prior

processing and may prevent you from receiving orders.

Under the PDPL we process personal data only where we have a lawful basis. We rely on the bases below:

• Performance of a contract / the driver relationship with you — to register and verify you, assign and

manage deliveries, calculate earnings and collections, provide support, and operate the App.

• Compliance with a legal obligation — tax, labour, transport, anti-fraud, and record-keeping obligations,

and responding to lawful requests from competent authorities.

• Legitimate interests / operation of our service — to secure the platform, prevent fraud (including

detecting rooted devices and GPS spoofing), improve reliability, and protect our users and business,

balanced against your rights.

• Your consent — for precise and background location collection, push notifications, and any optional

processing. You may withdraw consent at any time (Section 10); withdrawal does not affect prior

processing and may prevent you from receiving orders.

6. Location and notifications

Prominent disclosure and consent. The App collects location data to enable order dispatch, navigation, delivery tracking, and delivery verification, including in the background while you are on-duty, even when the App is closed or not in use. We request your permission before collecting location, and you can change or revoke location and notification permissions at any time in your device settings. Some core features will not work if location is disabled.

We use push notifications (via Firebase Cloud Messaging) to alert you to new orders, status changes, and important service messages.

7. When and with whom we share data

We do not sell your personal data. We share it only as needed for the purposes above:

• Customers and vendors — your first name, photo, approximate/live location, and contact method may

be shared to enable and track a delivery.

• Service providers (processors) — hosting, mapping/navigation, analytics and crash reporting

(Google/Firebase), messaging, identity verification, and payment/payout providers, acting under contract

on our behalf.

• Payment and financial partners — to process earnings, payouts, and reconcile collections.

• Authorities and legal — competent Saudi authorities, regulators, or courts where required by law or to

protect rights, safety, and against fraud.

• Corporate transactions — in connection with a merger, acquisition, or reorganisation, subject to this

policy.

We do not sell your personal data. We share it only as needed for the purposes above:

• Customers and vendors — your first name, photo, approximate/live location, and contact method may

be shared to enable and track a delivery.

• Service providers (processors) — hosting, mapping/navigation, analytics and crash reporting

(Google/Firebase), messaging, identity verification, and payment/payout providers, acting under contract

on our behalf.

• Payment and financial partners — to process earnings, payouts, and reconcile collections.

• Authorities and legal — competent Saudi authorities, regulators, or courts where required by law or to

protect rights, safety, and against fraud.

• Corporate transactions — in connection with a merger, acquisition, or reorganisation, subject to this

policy.

8. Third-party services in the App

The App uses Google and Firebase services (Analytics, Crashlytics, Cloud Messaging, and Google Play Services / Play Integrity) and Google Maps/location services. These providers process data under their own terms and privacy notices. We configure them to collect only what is needed to run and secure the App.

See Google’s Privacy Policy at https://policies.google.com/privacy.

9. International transfer of data

Some of our providers (e.g. cloud and analytics services) may process data outside the Kingdom of Saudi Arabia. Where we transfer personal data abroad, we do so only in accordance with the PDPL and SDAIA requirements, for example to a jurisdiction offering an adequate level of protection, or under appropriate safeguards and, where required, your consent or SDAIA approval.

10. How long we keep your data

We keep personal data only for as long as necessary for the purposes above and to meet legal, tax, and regulatory retention obligations, after which it is securely deleted or anonymised.

Typical periods: account and delivery records for 1 year after your relationship with us ends; financial and collection records for lifetime. Specific periods are set out in our internal retention schedule.

We keep personal data only for as long as necessary for the purposes above and to meet legal, tax, and regulatory retention obligations, after which it is securely deleted or anonymised.

11. How we protect your data

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, secure credential storage, device-integrity and anti-fraud checks, and staff confidentiality obligations. If a personal-data breach occurs, we will notify SDAIA and affected individuals where required, in line with the PDPL (including the 72-hour notification expectation).

12. Your responsibilities for customer and vendor data

When the App shows you customer or vendor personal data, you act on Lugmety’s behalf. You must: use it

only to complete the assigned delivery; not copy, store, photograph, share, or contact customers for any other purpose; and delete/return it when the delivery is done. Misuse of customer data is a serious breach of these terms and of the PDPL and may result in termination and legal action.

When the App shows you customer or vendor personal data, you act on Lugmety’s behalf. You must: use it

13. Your rights under the PDPL

Subject to conditions and exceptions in the PDPL, you have the right to:

• Be informed about how we collect and use your data (this policy).

• Access your personal data and obtain a copy.

• Request correction of inaccurate or incomplete data.

• Request deletion where the data is no longer needed and no legal basis requires us to keep it.

• Request transfer (portability) of data you provided, in a readable format.

• Withdraw consent at any time for processing based on consent.

To exercise these rights, contact us at operations@lugmety.com. We respond within the timeframe required by the PDPL. If you are unsatisfied, you may complain to the Saudi Data & AI Authority (SDAIA).

Subject to conditions and exceptions in the PDPL, you have the right to:

• Be informed about how we collect and use your data (this policy).

• Access your personal data and obtain a copy.

• Request correction of inaccurate or incomplete data.

• Request deletion where the data is no longer needed and no legal basis requires us to keep it.

• Request transfer (portability) of data you provided, in a readable format.

• Withdraw consent at any time for processing based on consent.

14. Children

The App is intended only for adults aged 18 or over who are eligible to work as delivery drivers. We do not knowingly collect data from children.

15. Change to this policy

We may update this policy from time to time. We will post the updated version in the App and on our website and, where changes are material, notify you. The "Last updated" date shows the latest version.