This policy explains how the Madar platform collects, uses and protects personal data, and the rights of the people that data relates to, in accordance with the Personal Data Protection Law issued by Royal Decree No. 6/2022 and its Executive Regulations. It applies to the website, the office web panel and the staff app, and should be read together with the Terms & Conditions.
1. Who we are and our role in processing data
- Madar is the operator of the platform and is referred to in this policy as “Madar”, “we” or “us”.
- Data about offices, their users and website visitors: Madar is the controller of this data and decides the purposes and means of its processing.
- Customer data entered by a rental office: the Office is the controller of this data, and Madar is a processor that handles it on the Office’s behalf, on its instructions and only to provide the service to it.
- If you are a customer of a rental office that uses Madar, the Office is responsible to you for your data. We recommend contacting the Office first, and we will help the Office respond to your request.
2. The data we collect
From offices and their users:
- Office details: its name, commercial registration number, a copy of the registration if uploaded, the owner’s name and mobile number, and branch details.
- User details: name, mobile number, email address, role, permissions and branch.
- Usage and security data: registered devices, IP addresses, sign-in records, the audit log of actions, and device notification tokens.
Customer data entered by the Office:
- Name, nationality, ID, driving licence and passport numbers and images, phone number and email address.
- Signatures, rental contracts, payments, vehicle inspection photos at handover and return, and traffic violations linked to contracts.
From website visitors:
- What you send through the “Contact us” form, and your messages to the AI assistant on the website.
- Technical data such as your IP address and browser type, to protect the website and prevent misuse, and analytics data if analytics is enabled (see section 7).
3. How we use data and the legal basis
- Providing the service to offices: reviewing applications, creating accounts and signing users in, running the platform’s features, and support. Basis: performing our agreement with the Office.
- Security and preventing misuse: verifying mobile numbers, the audit log, managing devices and sessions, and investigating incidents. Basis: our legitimate interest in protecting the platform and offices, and our legal obligations.
- Communication: sending verification codes and service notifications, and replying to visitors’ messages.
- Legal obligations: meeting what the law requires and responding to requests from competent authorities made in accordance with the law.
- Improving the service: aggregate usage statistics that do not identify individuals.
- We process customer data only to provide the service to the Office, and we do not use it for our own purposes or for marketing.
- We do not sell or rent personal data to anyone.
4. The Office’s responsibility for its customers’ data
As the controller of its customers’ data, the Office undertakes to:
- have a lawful basis for collecting customer data and obtain customers’ consent where the law requires it, especially for images of IDs, licences and passports and for signatures;
- inform its customers that their data is processed and for what purposes, and that it is kept on the Madar platform as a processor acting on the Office’s behalf;
- collect only what it needs for the rental and to meet its legal obligations, and keep it accurate;
- limit permission to view sensitive data to the users who need it, and review the audit log when needed;
- respond to its customers’ requests regarding their rights in accordance with the law; we help it do so with the tools available.
5. WhatsApp verification and notifications
- Signing in, and verifying the owner’s number when an office applies to join, use a code sent on WhatsApp, with no passwords. We send these messages through a WhatsApp messaging provider, so the provider and WhatsApp receive the mobile number and the message text, and their processing of it is governed by their own policies.
- We may also send service-related messages on WhatsApp, such as the outcome of an application to join and account notifications.
- The staff app uses the device’s notification token to send work alerts, which can be turned off in the device settings.
6. The AI assistant and the contact form
- Messages you write to the AI assistant on the website are sent to an AI service provider to generate answers, and we keep the conversation to follow up on enquiries and the quality of the answers. Do not send the assistant sensitive personal data such as ID numbers.
- We use what you send through the “Contact us” form only to reply to you and follow up on your request.
7. Cookies and analytics
- The website and the office panel use cookies that are necessary to run and protect them, such as the sign-in session and protection against forged requests.
- If analytics is enabled, we use Google Analytics on the public website pages only, to measure visits in aggregate, with ad personalisation turned off. Analytics does not run in the office panel or the staff app, and we do not use advertising cookies.
- You can block analytics cookies in your browser settings without affecting how the website works.
8. Who we share data with
- Within the Office: the Office’s users see data according to their roles, permissions and branches, and no office can see another office’s data.
- The Madar team: our authorised staff access data only to the extent necessary to review applications, provide support, keep the platform secure and maintain it.
- Service providers working on our behalf under contractual data-protection obligations: the hosting provider, the WhatsApp messaging provider, device notification services, the AI service provider for the website assistant, and Google Analytics if analytics is enabled.
- Government and judicial authorities: only when the law requires it or on a lawful request from a competent authority.
- We do not sell personal data or share it for marketing purposes.
9. Integration with government authorities
Government integration in the platform is a proposed concept and is not active, and Madar does not currently send any data to any government authority. If a real integration is enabled later after approval by the competent authorities, we will inform offices in advance and update this policy to explain what data is sent, which authority receives it and on what basis.
10. Hosting and transfers outside the Sultanate of Oman
Data is stored on servers with a hosting provider, and some service providers may process data outside the Sultanate. We apply contractual and technical safeguards to any transfer of data outside the Sultanate of Oman as required by the law and its Executive Regulations.
11. Data security
We apply technical and organisational measures to protect data, including:
- isolating each office’s data from every other office, with isolation enforced on the server and not only in the interface;
- encrypting ID and licence numbers and showing them masked; viewing them in full requires a permission and is logged;
- keeping documents and photos in private storage that can only be opened through temporary links valid for 5 minutes;
- an audit log of actions: who created a contract, who changed it, who viewed a customer’s data, and when;
- signing in with a WhatsApp code rather than passwords, locking the app automatically after a period of inactivity with fingerprint or face unlock, and the ability to revoke any device’s sessions.
No protection is absolute. If a security incident affects personal data, we will notify the affected offices without undue delay, notify the competent authority as the law requires, and help the Office meet its obligations towards its customers.
12. Retention and the end of a subscription
- We keep the Office’s data and its customers’ data while the subscription is active, and contracts and tax invoices for the period the law requires.
- When the subscription ends, the Office may request an export of its contracts as a CSV file and then the deletion of its data, except what the law requires to be kept, which we keep only for the required period and then delete.
- We keep sign-in records and the audit log for as long as needed for security and investigation purposes and as the law requires.
- We keep “Contact us” messages and AI assistant conversations for as long as needed to reply to and follow up on them.
13. Data subject rights
Under the Personal Data Protection Law, the data subject has the right to:
- access their data and obtain a copy of it;
- correct, update or complete their data;
- request deletion of their data, subject to what must be kept by law;
- withdraw their consent where it is the basis for processing, and object to processing in the cases set by law;
- be informed of any breach affecting their data, in accordance with the law;
- file a complaint with the authority responsible for personal data protection in the Sultanate of Oman (the Ministry of Transport, Communications and Information Technology).
Offices, their users and website visitors exercise their rights by contacting us. Customers of offices should first contact their rental office, as the controller of their data, and we help the Office respond; if a customer contacts us directly, we refer the request to their office and let them know. We respond to requests within the period set by law.
14. Changes to this policy
We may update this policy. We will notify offices of material changes through the office panel or the contact details registered with us before they take effect, and the date of the last update is shown above. This policy is written in Arabic and English; if the two texts differ, the Arabic text prevails.
15. Contact
For any question about privacy or to exercise your rights, use the “Contact us” page on the website.