Privacy Policy
Rebat Althiqah Information Technology Company (“Rebat”, “we”, “us”) respects the privacy of its users and is committed to protecting their personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its implementing regulations.
This policy explains what data we collect when you use the Rebat student app, the Rebat driver app or the website rebat.sa (together, the “Service”), how we use, share and protect it, and the rights you have. By using the Service you acknowledge that you have read this policy. The Arabic version of this policy prevails in case of any inconsistency.
1. Who is responsible for your data
Rebat is the controller of the personal data processed through the Service. You can contact us about privacy at any time at [email protected] or +966 50 325 9999.
2. Data we collect
We collect the minimum data needed to provide safe, reliable university transport, including:
- Account data: mobile number, name, email address (optional), account type (student or driver) and preferred language.
- Student data: university, campus and gate, pickup location, trip schedule and subscription details.
- Driver data: national ID or iqama, driving licence, vehicle registration and vehicle details, personal and vehicle photos, and the IBAN used for payouts.
- Location data: a driver’s location is collected continuously only for the duration of an active trip, including while the app runs in the background or the screen is locked during that trip, with a persistent notification showing this; collection stops when the trip ends. A student’s location is used to set the pickup point and to follow the trip while the app is in use.
- Trip data: trip history, times, routes and statuses, ratings and feedback.
- Payment data: card payments are processed by the licensed payment provider Moyasar, and Rebat never stores your full card details. We keep transaction references, amounts and statuses, invoices, and driver earnings and settlement records.
- Communication and safety data: support tickets, in-app chat messages, emergency (SOS) alerts, and the names and numbers of trusted contacts you add yourself.
- Technical data: your device’s push notification token (Firebase Cloud Messaging), device model, operating system, app version, IP address, and the error and usage logs needed to keep the Service secure and stable.
- Website account-deletion form: mobile number, account type and, if you give one, your reason for leaving.
3. Why we process your data and on what basis
We process your data for the following purposes, based on performing our contract with you, complying with a legal obligation, a legitimate interest that does not override your rights, or your consent where required:
- Creating your account and verifying your mobile number with a one-time code.
- Providing transport: managing subscriptions, planning trips, matching students with drivers and showing the vehicle’s position during a trip.
- Safety: live trip tracking, the emergency feature, and notifying your trusted contacts when you ask us to.
- Verifying drivers’ eligibility, documents and vehicles before onboarding and throughout their service.
- Processing payments, issuing invoices and paying out driver earnings.
- Regulatory compliance, including reporting trips and drivers through Elm’s WASL platform as required by the Transport General Authority.
- Sending service messages: verification codes by SMS, push notifications and account or trip emails.
- Customer support and handling complaints and disputes.
- Protecting the Service, preventing fraud and misuse, and improving performance and quality.
- Meeting legal obligations and responding to requests from competent authorities.
We do not use your data for third-party marketing, and we do not sell your personal data.
5. Transfers outside Saudi Arabia
Some technology providers, such as Google and Firebase, may process part of the data on servers outside the Kingdom of Saudi Arabia. In those cases we follow the controls set by the PDPL and the regulation on transferring personal data outside the Kingdom, and limit the transfer to the minimum data needed.
6. How long we keep data
We keep your data while your account is active and as long as needed for the purposes above. When an account is deleted, your personal data is deleted or anonymised so it can no longer be linked to you, except for records we are legally required to keep: trip records, payments, invoices, driver earnings and settlements, ratings and audit logs. These records are kept in anonymised form as far as possible and only for the period the applicable laws require.
7. Deleting your account
You can request deletion of your account at any time, in either of two ways:
- In the app: Profile → Delete account.
- On the website, through the “Delete account” page (rebat.sa/en/delete-account), after verifying your mobile number.
Once you submit the request, a 30-day grace period starts, during which you can cancel the request from the app. When the grace period ends, the account is anonymised: your name, mobile number, email address and photo are removed, sign-in sessions, notification tokens and trusted contacts are deleted, and driver documents are deleted unless the law requires us to keep them. Your mobile number becomes free to register again. The financial and operational records listed in section 6 are retained as the law requires.
Deletion may be deferred while a trip is in progress or financial obligations are unsettled; we will tell you if this happens and why.
8. Your rights
Under the PDPL you have the right to:
- Be informed of how and why your data is collected and processed.
- Access your data and obtain a copy of it in a readable, clear format.
- Have your data corrected, completed or updated.
- Request destruction of your data once it is no longer needed, subject to what the law requires us to retain.
- Withdraw consent to processing that is based on consent, without retroactive effect.
- Lodge a complaint with the competent authority, the Saudi Data & AI Authority (SDAIA).
To exercise any of these rights, email [email protected] from the email address or mobile number linked to your account. We will respond within the period set by law and may ask you to verify your identity first.
9. Security
We apply appropriate technical and organisational measures to protect your data, including encrypted connections between the apps and our servers, need-to-know access controls, one-time-code sign-in, and never storing card data ourselves. No method of electronic transmission or storage is completely secure; we will notify you and the competent authority of any personal data breach as the law requires.
10. Device permissions
The apps may ask for location, notification and camera or photo library access (to upload documents and photos). You can manage these permissions in your device settings at any time; refusing them may disable core features such as trip tracking or driver document upload.
11. Users under the legal age
The Service is intended for university students and adult drivers. A student under 18 may use the Service only with her guardian’s consent. If we learn that we have collected a minor’s data without the required consent, we will delete it.
12. Website and cookies
rebat.sa does not use advertising cookies or third-party analytics trackers. Our server may log basic technical data (such as IP address and browser type) for security and to operate the site.
13. Changes to this policy
We may update this policy from time to time. We will publish the updated version on this page with its last-updated date, and notify you in the app or by another suitable means of any material change.
14. Contact us
Rebat Althiqah Information Technology Company — Kingdom of Saudi Arabia.
Email: [email protected] — Phone: +966 50 325 9999.