MENA Motion Privacy Policy

This Privacy Policy applies to information we collect through our website, web and mobile applications, communications (including email, SMS, and in-platform messaging), application programming interfaces (APIs), integrations, support channels, and any other services that link to or reference this Privacy Policy.

This Privacy Policy does not apply to third-party websites, applications, or services that we do not own or control, including services you access through links or integrations on the Platform. We encourage you to review the privacy practices of those third parties before using their services.

MENA Motion operates across multiple jurisdictions and processes personal data in accordance with the laws that apply where data subjects are located and where we operate. This includes, without limitation:

• United States — Federal and State Law,including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”), and comparable consumer privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, and other U.S. states as those laws come into effect.
• Kingdom of Saudi Arabia — Personal Data Protection Law (PDPL), issued by Royal Decree No. (M/19) dated 09/02/1443 AH (16 September 2021), as amended, together with its Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom. The PDPL is administered and enforced by the Saudi Data & Artificial Intelligence Authority (“SDAIA”), which operates the National Data Management Office (“NDMO”) and the National Data Governance Platform.
• Kingdom of Bahrain — Personal Data Protection Law,Law No. (30) of 2018 (the “Bahrain PDPL”), administered by the Personal Data Protection Authority of Bahrain.

Where local law in your jurisdiction grants you rights or imposes obligations on us that go beyond those described elsewhere in this Privacy Policy, those local rights and obligations apply to your personal data. Region-specific disclosures are set out in Section 13.

The Platform is used by several categories of users, and the personal data we collect depends on the role you play:

• Shippers — individuals and businesses that book freight or delivery services through the Platform.
• Carriers — motor carriers, courier companies, fleet operators, and other licensed transportation providers that accept and perform shipments through the Platform.
• Drivers — individuals operating vehicles on behalf of a Carrier (or as owner-operators) to perform pickups and deliveries.
• Receivers — individuals and businesses designated to receive shipments.
• Administrators & logistics partners — team members, dispatchers, and authorized partners who use the Platform on behalf of a Shipper, Carrier, or other organization.
• Visitors — anyone who visits our website, downloads our applications, or otherwise interacts with us without creating an account.

The same individual may act in more than one role over time. Where we describe a category of personal data below, we indicate which roles it typically applies to.

We collect two general types of information:

• Personal Information — information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or household, whether directly or indirectly.
• Anonymous or De-Identified Information — information that does not identify, and cannot reasonably be used to identify, an individual. Where we combine anonymous information with personal information, we treat the combined information as personal information.

4.1 Account & Contact Information

When you create an account, request information, apply for a position with us, or otherwise communicate with us, we collect contact details such as your name, business or company name, job title, email address, telephone number, postal or business address, and account credentials.

4.2 Shipment & Operational Data

When you create or accept a shipment, we collect details necessary to plan and perform the delivery, including pickup and delivery addresses, receiver name and contact details, shipment description, declared value, dimensions and weight, commodity type, special handling instructions, route and stop information, scheduled and actual times, and exception or incident reports.

4.3 Payment Information

Payments and payouts on the Platform are processed through secure third-party payment service providers, including Stripe. We do not store full credit card numbers, full bank account numbers, or other complete financial credentials on our servers. We may store limited payment metadata, such as card brand, last four digits, billing name and ZIP/postal code, transaction history, and tokenized identifiers issued by our payment processors.

4.4 Banking & Tax Information

Carriers and Drivers receiving payouts, and team members receiving wages, are asked to provide bank account and tax information through our third-party payment and payroll providers so that we can pay you and meet our tax, accounting, and regulatory obligations. This may include taxpayer identification numbers (such as a U.S. EIN or SSN, a Saudi Tax Identification Number, or a Bahrain Commercial Registration number), tax forms (such as W-9, W-8BEN, or local equivalents), and electronic invoicing details required for ZATCA FATOORAH compliance in Saudi Arabia.

4.5 Carrier & Driver Information

To onboard, verify, and manage Carriers and Drivers, we collect information needed to confirm legal eligibility, regulatory compliance, and operational fitness. Depending on the role and jurisdiction, this may include:

• Company information, including legal name, ownership structure, business registration documents, and authorized signatories.
• Operating authority and compliance records, such as U.S. Department of Transportation (DOT) and Motor Carrier (MC) numbers, FMCSA safety ratings, U.S. state operating authority, Saudi Transport General Authority registrations, Nafith and TPID identifiers, and Bahrain regulatory registrations.
• Insurance information, including cargo, automobile liability, workers’ compensation, and general liability policies, certificate holders, and additional insured details.
• Driver identity and authorization documents, including driver’s license, national ID, IQAMA (Saudi residency permit), passport, U.S. work authorization documents, DOT medical card (where applicable), and CDL endorsements.
• Vehicle information, including registration (Istimara in Saudi Arabia), vehicle type and class, plate number, make, model, year, capacity, and inspection or maintenance records.
• Personnel information about your drivers, dispatchers, and other team members where you have authorized us to collect it on your behalf for compliance, safety management, or platform administration.

4.6 Background & Compliance Check Information

Where required by law or by our Carrier onboarding standards, we may direct you to provide certain personal information to one or more unaffiliated background-check or compliance-verification vendors. These vendors may collect and process additional information, including driving records, criminal history checks, and identity-verification data, and they may share the results of those checks with us. Information you provide directly to a background-check vendor is governed by that vendor’s privacy policy as well as this Privacy Policy.

4.7 Location Data

With appropriate consent and in accordance with the permissions you grant on your device, we collect real-time GPS location data from Drivers and vehicles during active deliveries to enable shipment tracking, delivery coordination, route optimization, exception management, safety monitoring, and operational visibility for Shippers and Receivers. We may also collect approximate location information derived from your IP address or device identifiers when you access the Platform, for security, fraud prevention, and analytics purposes.

4.8 Media & Proof of Delivery

Drivers, Carriers, and Receivers may upload photos, videos, signatures, scanned documents, and other materials through the Platform to confirm pickup, delivery, condition of cargo, exceptions, and proof of delivery. These materials may include images of cargo, packaging, vehicles, and locations, and may incidentally capture personal information of individuals present at the pickup or delivery site.

4.9 Communications & Support Data

When you contact us through email, in-platform messaging, SMS, telephone, or chat, we collect the content of those communications, contact identifiers, and metadata such as date, time, and channel. We may record customer support calls for quality, training, dispute-resolution, and compliance purposes, where permitted by law and where we have notified you in advance.

4.10 Technical & Usage Data

When you use the Platform, we automatically collect technical and usage information, including IP address, device type and identifiers, operating system, browser type and version, language preference, network and mobile carrier information, referring URLs, pages and screens viewed, features used, click and tap activity, session duration, error logs, crash data, and similar information.

4.11 Cookies, Pixels & Similar Technologies

We and our service providers use cookies, pixels, software development kits (SDKs), local storage, and similar technologies to operate the Platform, remember your preferences, authenticate sessions, prevent fraud, measure performance, and understand usage. See Section 14 for more detail.

4.12 Sensitive Personal Information

Some of the information described above is treated as “sensitive personal information” under the CCPA/CPRA and as “sensitive personal data” under the KSA PDPL and Bahrain PDPL, including government-issued identification numbers, precise geolocation, financial account information, and certain identity-verification data. We collect and use sensitive personal information only as necessary to operate the Platform, comply with legal and regulatory obligations, prevent fraud, and protect users, and we do not use it to infer characteristics about you for purposes unrelated to the services you have requested. See Section 13 for your right to limit the use of sensitive personal information where applicable.

5.1 Directly From You

We collect information you provide directly when you create an account, complete onboarding, book or accept a shipment, upload documents, communicate with our support team, respond to surveys, or otherwise interact with us.

5.2 Automatically

We collect information automatically as you use the Platform through cookies, pixels, SDKs, server logs, and similar technologies. This includes technical data, usage data, approximate location, and information about your interactions with our communications.

5.3 From Service Providers and Partners

We receive information from service providers we engage to help us operate the Platform, including payment processors, fraud-prevention vendors, identity-verification and background-check vendors, mapping and routing providers, communications providers, hosting and security providers, analytics providers, and compliance and tax-reporting partners.

5.4 From Other Platform Users

We receive information about you from other Platform users when, for example, a Shipper provides Receiver contact details, a Carrier registers Drivers under its account, or a Receiver provides feedback about a delivery.

5.5 From Public and Authorized Sources

We may receive information from public registries, government agencies, regulators, sanctions lists, and other authorized sources to verify business identity, operating authority, regulatory standing, and compliance.

5.6 Analytics

We use analytics services, including Google Analytics, to understand how users interact with the Platform and to improve performance and user experience. These services may use cookies and similar technologies to collect information about your use of the Platform and combine it with information from other services. For information about how Google uses data collected through Google Analytics, see policies.google.com/technologies/partner-sites.

Where required by KSA PDPL, Bahrain PDPL, or other applicable laws, we process personal data on one or more of the following legal bases:

• Performance of a contract — to provide the Platform and the services you have requested, including matching shipments, coordinating deliveries, processing payments, and providing support.
• Compliance with legal obligations — to comply with tax, accounting, transportation, anti-money-laundering, sanctions, electronic-invoicing, and other regulatory obligations in the jurisdictions where we operate.
• Legitimate interests — to operate, secure, and improve the Platform; to prevent and detect fraud, abuse, and unauthorized activity; to manage and protect our business; and to communicate with you about our services, where those interests are not overridden by your rights and freedoms.
• Consent — for activities that require your consent under applicable law, such as collection of precise location data, certain marketing communications, and certain cross-border transfers. You may withdraw consent at any time by contacting us at privacy@menamotion.com or by using the controls described in Section 12.
• Vital interests and public interest — in limited circumstances, to protect the vital interests of an individual or to respond to lawful requests in the public interest.

We use the information we collect for the following purposes:

• Provide, operate, maintain, and improve the Platform.
• Match shipments with Carriers and Drivers and coordinate deliveries.
• Enable real-time tracking, route optimization, and exception management.
• Process payments and payouts and manage invoicing, including ZATCA FATOORAH e-invoicing where applicable.
• Provide proof of delivery and support shipment dispute resolution.
• Onboard, verify, and manage Carriers and Drivers, including identity, regulatory, insurance, and background checks.
• Communicate with you about your account, transactions, service updates, and policy changes.
• Provide customer support and resolve incidents, complaints, and claims.
• Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized activity.
• Comply with legal, tax, accounting, regulatory, sanctions, and reporting obligations.
• Enforce our terms of service, carrier agreements, and other contractual obligations.
• Conduct analytics, research, and product development to improve the Platform.
• Protect the rights, property, and safety of MENA Motion, our users, and others.

7.1 Aggregated and De-Identified Information

We may aggregate, de-identify, or anonymize information so that it no longer identifies an individual, and we may use and disclose that information for any lawful purpose, including analytics, benchmarking, market research, performance reporting, product development, and discussions with prospective business partners or investors. Where required by law, we maintain commitments not to attempt to re-identify de-identified data and to require the same of any recipients.

7.2 Marketing & Communications

With your consent where required, we may use your contact information to send marketing emails, SMS messages, and other communications about the Platform, new features, promotions, and content we believe may be of interest to you. You may opt out of marketing emails at any time by following the unsubscribe instructions in any marketing email, by replying STOP (or the local equivalent) to a marketing SMS, or by contacting us at privacy@menamotion.com. Even if you opt out of marketing communications, we will continue to send you transactional and service-related communications necessary to operate your account and the Platform.

We do not sell personal information for monetary consideration. We share personal information only as described in this Privacy Policy and only with the categories of recipients listed below.

8.1 Between Platform Users to Facilitate Delivery Services

To enable freight and delivery services on the Platform, we share information among Shippers, Carriers, Drivers, Receivers, and their authorized representatives. This may include shipment details, contact details, vehicle details, real-time location updates, photos, signatures, and proof-of-delivery materials.

8.2 Service Providers

We share information with service providers that perform services on our behalf, including cloud hosting (such as Google Cloud Platform), payment processing, payroll and tax reporting, identity verification and background checks, mapping and routing, communications and notifications, customer support tooling, analytics, security and fraud prevention, document storage, and professional advisors. We require service providers to use information only as instructed by us and consistent with this Privacy Policy and applicable law.

8.3 Insurance Partners

We may share information with insurance carriers, brokers, and claims administrators in connection with cargo, automobile liability, general liability, and other coverage, including for underwriting, claims handling, subrogation, and any Loss Protection Program we may offer.

8.4 Compliance & Regulatory Vendors

We share information with vendors that help us meet legal, regulatory, and tax obligations, including electronic-invoicing providers (for ZATCA FATOORAH and similar regimes), anti-money-laundering and sanctions-screening providers, and licensed compliance partners.

8.5 Integrations and APIs

If you connect a third-party service to the Platform, or access the Platform through a third-party integration, we may share information with that third party as necessary to provide the integration. Information shared through an integration is also governed by the third party’s privacy policy.

8.6 Legal, Safety, and Regulatory Disclosures

We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, court orders, subpoenas, or lawful requests from government, regulatory, tax, or law-enforcement authorities; to enforce our terms of service or other agreements; to protect the rights, property, or safety of MENA Motion, our users, or others; to respond to fraud, security, or technical issues; or to defend against legal claims.

8.7 Business Transactions

We may disclose information in connection with, or during negotiations of, any merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar business transaction. Where required by applicable law, we will notify affected individuals.

8.8 With Your Consent or at Your Direction

We may share information with other parties when you direct us to do so or when you have provided your consent.

MENA Motion is headquartered in the United States and operates across multiple jurisdictions. Your personal information may be transferred to, stored in, and processed in countries other than the one in which you reside, including the United States, the Kingdom of Saudi Arabia, the Kingdom of Bahrain, and other countries where we or our service providers operate. The data-protection laws in those countries may differ from those in your home country.

9.1 Data Residency and Inter-Entity Transfers

We use Google Cloud Platform as our primary cloud infrastructure provider. Personal data of individuals located in Saudi Arabia is processed in the GCP me-central2 region (Dammam, Kingdom of Saudi Arabia) wherever feasible, in support of in-Kingdom data residency. Personal data of individuals located in the United States is generally processed in U.S. regions. We may use additional regions for redundancy, disaster recovery, and global operations, subject to the safeguards described below.

Personal data may be transferred between MENA MOTION L.L.C. (Delaware, USA) and MENA MOTION W.L.L. (Kingdom of Bahrain) for the purpose of operating the Platform globally, providing customer support, processing payments, fraud prevention, security, regulatory reporting, accounting, and consolidated business analytics. These intra-group transfers are governed by an internal data-sharing arrangement that imposes obligations consistent with this Privacy Policy and applicable law.

9.2 Transfer Safeguards

Where personal data is transferred internationally, we use safeguards designed to provide an appropriate level of protection, including:

• Data-processing agreements with service providers that include confidentiality, security, and data-protection obligations.
• Standard Contractual Clauses or comparable contractual instruments where required.
• Technical and organizational safeguards including encryption in transit and at rest, access controls, and logging.
• For transfers from Saudi Arabia, compliance with the Regulation on Personal Data Transfer Outside the Kingdom and any applicable SDAIA approvals or whitelist determinations.
• For transfers from Bahrain, compliance with the Bahrain PDPL and any required authorizations from the Personal Data Protection Authority.

We use technical, administrative, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These safeguards include encryption in transit, encrypted storage of credentials and sensitive identifiers, role-based access controls, multi-factor authentication for administrative access, network segmentation, vulnerability management, secure software development practices, monitoring and logging, and contractual security requirements with our service providers.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify the competent authority and affected individuals as required by applicable law, including, where applicable, within 72 hours of becoming aware of the breach under the KSA PDPL.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to provide the Platform, comply with our legal, tax, accounting, and regulatory obligations, resolve disputes, enforce our agreements, and protect against fraud and misuse. Specific retention periods vary by data category, jurisdiction, and applicable legal obligation. Examples include:

When personal information is no longer needed, we delete, destroy, or anonymize it in accordance with our retention schedules and applicable law.

Depending on where you are located and the laws that apply, you may have some or all of the following rights with respect to your personal information:

• Right to be informed about how we collect and use your personal information.
• Right to access the personal information we hold about you and to receive a copy.
• Right to correct inaccurate or incomplete personal information.
• Right to deletion or destruction of personal information, subject to legal exceptions.
• Right to restrict or object to certain processing activities.
• Right to data portability, where applicable.
• Right to withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Right to opt out of certain marketing communications and certain disclosures, where applicable.
• Right to non-discrimination for exercising your rights.
• Right to lodge a complaint with the competent supervisory authority in your jurisdiction.

12.1 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@menamotion.com or use the contact details in Section 17. We will respond to verifiable requests within the timeframe required by applicable law — generally within 30 days under the KSA PDPL and Bahrain PDPL, and within 45 days under the CCPA/CPRA (extendable as permitted).

12.2 Verification

To protect your information, we may need to verify your identity before responding to a request. We may ask you to provide information that allows us to reasonably verify that you are the person about whom we hold personal information. We will use the information you provide for verification only and will delete it promptly afterward.

12.3 Authorized Agents

Where applicable law permits, you may use an authorized agent to submit a request on your behalf. We may require written authorization from you and verification of the agent’s identity.

12.4 Account Controls

You can update most of your account information, contact preferences, and notification settings through your account settings. You can also limit certain data collection by adjusting permissions on your device, including location and notification permissions, and through your browser’s cookie controls. Disabling certain features may limit your ability to use the Platform.

13.1 California (CCPA / CPRA)

If you are a California resident, you have specific rights under the CCPA/CPRA, in addition to the rights described in Section 12.

Categories of personal information collected

In the past 12 months, we have collected the following categories of personal information, as those categories are defined under the CCPA/CPRA: identifiers; customer records information; commercial information; internet or other electronic network activity information; geolocation data; audio, electronic, visual, or similar information (such as proof-of-delivery photos and call recordings); professional or employment-related information; inferences drawn from any of the above; and sensitive personal information (such as government identifiers, precise geolocation, and account credentials).

Sources of personal information

We collect personal information from you directly, automatically through your use of the Platform, from other Platform users, from service providers and partners (including payment processors and background-check vendors), and from public and authorized sources, as described in Section 5.

Business and commercial purposes

We use personal information for the purposes described in Section 7, including providing the Platform, performing services, security and fraud prevention, debugging, analytics, communications, and legal compliance.

Categories of recipients

We disclose personal information to the categories of recipients described in Section 8, including other Platform users, service providers, insurance partners, compliance vendors, and government and regulatory authorities.

Sale or sharing of personal information

We do not “sell” personal information for monetary consideration. We do not knowingly “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We do not “sell” or “share” the personal information of consumers we know to be under 16. If our practices change, we will update this Privacy Policy and provide a “Do Not Sell or Share My Personal Information” mechanism.

Sensitive personal information

We use sensitive personal information only for the purposes permitted under the CCPA/CPRA, including providing the services you request, ensuring security and integrity, preventing fraud, performing services on our behalf, and complying with law. You have the right to limit our use of your sensitive personal information to those permitted purposes by contacting us at privacy@menamotion.com.

Your California rights

California residents have the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, the right to data portability, and the right to non-discrimination. Submit requests to privacy@menamotion.com. You may also designate an authorized agent to make a request on your behalf.

13.2 Other U.S. State Privacy Laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, or another U.S. state with a comprehensive consumer privacy law, you may have rights similar to those described above, including rights to access, correct, delete, port, and opt out of certain processing activities. To exercise these rights, contact us at privacy@menamotion.com. If we deny your request, you may have the right to appeal that decision; we will respond to appeals within the time required by your state’s law.

13.3 Kingdom of Saudi Arabia (PDPL)

If you are a data subject located in the Kingdom of Saudi Arabia, the following additional information applies under the PDPL and its Implementing Regulations:

• Data Controller: MENA MOTION W.L.L. (Kingdom of Bahrain), operating the Platform for users in the MENA region, contactable at privacy@menamotion.com. Personal data may also be shared with MENA MOTION L.L.C. (Delaware, USA) as a joint controller for global Platform operations and reporting.
• Privacy Officer / Data Protection Officer: Our Privacy Officer is responsible for overseeing PDPL compliance, responding to data-subject requests, and acting as the point of contact with SDAIA. Contact details are set out in Section 17.
• Your rights include the right to be informed, the right of access, the right to request correction, the right to request destruction, and, where applicable, the right to withdraw consent. We will respond to verifiable requests within 30 days of receipt.
• Cross-border transfers: Where personal data is transferred outside the Kingdom, we comply with the Regulation on Personal Data Transfer Outside the Kingdom, including required assessments and safeguards. Personal data of individuals located in Saudi Arabia is, wherever feasible, processed in the GCP Dammam (me-central2) region.
• Right to complain:You have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform if you believe our processing of your personal data does not comply with the PDPL.

13.4 Kingdom of Bahrain (PDPL)

If you are a data subject located in the Kingdom of Bahrain, the following additional information applies under Law No. (30) of 2018:

• Data Manager: MENA MOTION W.L.L., a Bahrain limited liability company (Commercial Registration No. 182389-1), located at Building 470, Road 1010, Block 410, Sanabis, P.O. Box 1406, Kingdom of Bahrain, contactable at privacy@menamotion.com. Personal data may also be shared with MENA MOTION L.L.C. (Delaware, USA) for global Platform operations and reporting.
• Your rights include the right to be informed, the right of access, the right to correct or block processing, the right to object to processing for direct marketing, and, where applicable, the right to withdraw consent.
• Cross-border transfers: Where personal data is transferred outside Bahrain, we comply with the Bahrain PDPL, including obtaining any required authorizations from the Personal Data Protection Authority.
• Right to complain: You have the right to lodge a complaint with the Personal Data Protection Authority of Bahrain if you believe our processing of your personal data does not comply with the Bahrain PDPL.

We use cookies and similar technologies to make the Platform work, remember your preferences, authenticate sessions, support security and fraud prevention, measure usage and performance, and improve our services. The categories of cookies we use include:

• Strictly necessary cookies — required for the Platform to function, such as session and authentication cookies.
• Functional cookies — remember your preferences and settings.
• Performance and analytics cookies — help us understand how the Platform is used and improve it, including through Google Analytics.
• Security cookies — support fraud prevention and abuse detection.

You can control cookies through your browser settings, including blocking or deleting cookies. Disabling certain cookies may limit your ability to use parts of the Platform. We currently do not respond to “Do Not Track” signals because no industry standard has been finalized; if that changes, we will update this Privacy Policy.

The Platform is intended for business and commercial use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a minor, please contact us at privacy@menamotion.com and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will notify users through the Platform, by email, or by other reasonable means, and we will update the Effective Date at the top of this Privacy Policy. Your continued use of the Platform after the updated Privacy Policy takes effect constitutes acceptance of the changes, except where additional consent is required by applicable law.

If you have questions about this Privacy Policy, our privacy practices, or your rights, or if you would like to submit a privacy request, please contact us:

A named Data Protection Officer is appointed to oversee compliance with the KSA PDPL and to act as our point of contact with SDAIA. Contact details for the Data Protection Officer can be obtained on request to privacy@menamotion.com.