Privacy Policy

All Oh Transportation (“we”, “us”, or “our”) operates the website at https://www.allohtransportation.com and provides chauffeur and ground-transportation services across the Kingdom of Saudi Arabia and the wider GCC. This Privacy Policy explains what personal information we collect from you, how we use it, who we share it with, and the rights you have under the Saudi Personal Data Protection Law (PDPL).

By using our website or booking a service, you confirm that you have read and understood this Policy.

1. Scope of this Policy

This Policy applies to personal information processed by All Oh Transportation in connection with our website, our booking and dispatch operations, and the chauffeur services we deliver to passengers and corporate clients. It does not cover the practices of any third-party website, application or service that you may access through links on our website.

2. Information we collect

We collect only the information needed to quote, confirm, deliver and bill the rides you request. Specifically:

2.1 Information you provide

• Contact details: your name, mobile number (WhatsApp) and, where supplied, your email address.
• Trip details: pickup and drop-off locations, date and time of travel, vehicle preference, flight number, and any notes such as luggage, stops or special requests.
• Communications: messages you send us through WhatsApp, email or our contact form.
• Corporate billing details (for account customers only): company name, billing address and tax registration number.

2.2 Information collected automatically

• Technical data: IP address, device type, browser, operating system, referring URL, and the pages you visit on our site (used solely for security and basic analytics).
• Cookies: a small CSRF cookie required to submit forms securely, plus optional analytics and advertising cookies described in section 8 that are set only after you accept them.

2.3 Payment information

Payment for services is collected either in cash at the time of service or online via our payment provider (Moyasar). When you pay online, your card details are entered directly into Moyasar's secure, PCI-DSS-compliant form — we never see or store your full card number, CVV or bank account details on our systems.

3. How we use your information

• To confirm, schedule and deliver the chauffeur service you booked.
• To send you quotes, booking confirmations, ride updates and driver details via WhatsApp and email.
• To dispatch the ride to the assigned chauffeur (driver receives your name, mobile number, pickup and drop-off addresses).
• To respond to your enquiries and provide customer support.
• To maintain our internal records, accounting and tax obligations under Saudi law.
• To detect and prevent fraud, abuse, or breaches of our Terms of Service.
• To improve our service quality through aggregate, non-identifying analytics.

4. Legal basis for processing

Under the Saudi Personal Data Protection Law (PDPL), we rely on the following legal bases:

• Performance of a contract — to fulfil the booking you request.
• Legitimate interests — to operate, secure and improve our service.
• Legal obligation — to keep records required by Saudi tax, transport and commercial regulations.
• Consent — for any processing that goes beyond the above (e.g. optional marketing messages); you can withdraw consent at any time.

5. Sharing & disclosure

We do not sell or rent your personal information. We share limited data only with parties who help us deliver the service:

• Assigned drivers / dispatch partners: name, mobile number, pickup & drop-off addresses, and ride time.
• Email delivery providers: the email address you supplied, so that confirmations and quotes can be sent.
• WhatsApp Business / Meta Platforms: the mobile number and message content you initiate via the WhatsApp link, governed by WhatsApp's own privacy terms.
• Hosting provider: our website is hosted on commercial infrastructure based in the Kingdom of Saudi Arabia / EU, with industry-standard contractual data-protection commitments.
• Government authorities or law enforcement: when required by a binding legal request under Saudi law.

6. Retention periods

• Booking records: retained for up to 7 years from the ride date, in line with Saudi accounting and tax retention requirements (ZATCA).
• Server log files: retained for up to 90 days, then automatically deleted.
• Marketing preferences: retained until you opt out.

When the retention period ends, your personal data is securely deleted or fully anonymised.

7. Security

We protect your data with the following measures:

• HTTPS encryption (TLS 1.2+) in transit on every page of our website.
• Secure session cookies with the HttpOnly, Secure and SameSite=Lax flags.
• CSRF protection on every form submission.
• Hashed passwords for admin accounts (bcrypt).
• Restricted access — only authorised personnel can view booking records.
• Daily database backups, retained for 30 days.

No system can be guaranteed 100% secure; we will notify affected customers and the competent Saudi authority if a data breach is likely to compromise your rights.

8. Cookies & tracking

We use two categories of cookies:

8.1 Strictly necessary cookies (always on)

• Session cookie — keeps your form submission secure (CSRF protection). Expires when you close the browser.
• Admin session cookie — only set after admin login.
• Consent cookie (aot_consent) — remembers your cookie choice for 12 months so we don't ask again.

8.2 Analytics & advertising cookies (only after you accept)

When you click Accept on our cookie banner, we enable Google Analytics and Google Ads cookies. These help us understand how visitors find and use our site and measure the effectiveness of our advertising, so we can reach more people who need a chauffeur. They may include:

• Google Analytics (_ga, _ga_*) — measures traffic sources and page usage in aggregate.
• Google Ads (_gcl_au and related) — measures which ad campaigns lead to bookings and enables remarketing.

We operate Google Consent Mode v2: these cookies stay disabled until you give consent, and you can withdraw consent at any time by clearing your browser cookies. We do not sell your personal data. If you click Reject, no analytics or advertising cookies are set and the site works exactly the same.

9. International data transfers

Your data is primarily processed within the Kingdom of Saudi Arabia. Where we use international service providers (for example, email delivery or WhatsApp messaging), the transfer is performed under contractual safeguards equivalent to the protections required by PDPL.

10. Your rights under PDPL

You have the right to:

• Be informed about how your personal data is processed.
• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to our legal retention obligations.
• Object to or restrict certain types of processing.
• Withdraw consent for any optional processing at any time.
• Lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe your rights have been infringed.

To exercise any of these rights, email us at info@allohtransportation.com. We will respond within 30 days.

11. Children's privacy

Our services are intended for adults who can lawfully enter into a contract under Saudi law. We do not knowingly collect personal data from children under the age of 13. Children may be passengers, but bookings must be placed by a parent, guardian or accompanying adult.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services or our practices. The current version is always posted on this page with the “Effective date” shown at the top. Material changes will be highlighted on our home page for at least 30 days.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact: