Hala Privacy Policy

Who we are and scope

Hala is owned and operated by Zahra Dijla Company for Delivery and Passenger Transport Services, LLC, based in Iraq. This policy applies to Hala passenger and driver applications, its website, and connected services. By using the service, you acknowledge that your data will be processed as described here and as necessary to provide the service.

Information we collect

• Account data: name, phone number, governorate, language, account type, profile photo, and information you add.
• Driver and vehicle data: identity, driving licence, vehicle information, photos, documents, verification, and approval records.
• Location data: pickup, destination, and precise location while using the app. The driver app may use background location while the driver is available or on a trip, subject to device permissions.
• Trip data: route, distance, time, fare, vehicle type, request status, cancellation, completion, and ratings.
• Payment and wallet data: payment method, balance, transactions, top-ups, deductions, and payment references. Full card details are entered with the payment gateway; Hala does not store the full card number or CVV in its systems.
• Messages and support: trip messages, support requests, complaints, and communications through approved channels.
• Device and usage data: device type, operating system, app version, notification tokens, security logs, error reports, and technical usage.

How we use information

• Create and verify accounts and provide ride services.
• Match passengers with drivers and enable trip-related location and communication.
• Calculate fares and process payments, wallets, commissions, and refunds.
• Send trip, transaction, service, and security notifications.
• Provide support, investigate incidents, and prevent fraud.
• Improve app performance, reliability, and user safety.
• Use vehicle locations during trips, without the driver's name or phone number, to improve maps and calculate traffic congestion.
• Meet legal obligations and respond to lawful authority requests.

How we share information

We do not sell personal data. We may share only what is necessary with:

• The matched driver or passenger to complete a ride, including necessary name, location, and vehicle details.
• Technology, maps, and notification providers, including Google Cloud, Firebase, and Google Maps.
• Payment gateways, including MEGA PAY and its connected payment processors.
• Communications and support providers, including WhatsApp and Twilio when those channels are used.
• Government or judicial authorities where required by law or necessary to protect rights, safety, and prevent fraud.

Service providers are required to use data for the defined purpose and protect it under their legal and contractual duties.

Location and permissions

Hala needs location access to set pickup and destination points, find nearby drivers, track trips, and support safety. You can control location permissions in device settings, but disabling them may prevent parts of the service from working. Camera, photos, and notification access are used only after permission is granted and when needed for the related feature.

Data retention and security

We retain information while an account is active and as needed to operate the service, settle transactions, prevent fraud, resolve disputes, and meet accounting and legal requirements. When data is no longer needed, we delete or de-identify it unless certain records must be kept by law.

We use technical and administrative safeguards including encrypted connections, access controls, identity verification, and security monitoring. No electronic transmission or storage method can, however, guarantee absolute security.

Your rights and choices

You can update information in the app where available, or contact us to request access, correction, deletion, or to object to certain processing. We may verify your identity before acting on a request. Records required for legal, safety, or financial purposes may be retained.

Children and policy updates

The service is not intended for independent accounts created by persons under 18. If we learn that a child's data was collected without a lawful basis, we will take appropriate steps to delete it. We may update this policy as our service or legal requirements change. We will publish the revised version here with a new update date and may provide notice of material changes.