Privacy Policy

Last updated: 3 June 2026

This Privacy Policy explains how VROOOM Trading and Services W.L.L. ("VROOOM", "we", "us") collects, uses, shares and protects your personal data when you use the VROOOM mobile application and our website at vrooom.me (together, the "Service"). VROOOM is the data controller responsible for your personal data.

We handle personal data in line with the State of Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) and the guidance of the competent authority — the National Cyber Security Agency and its National Data Privacy Office. Our approach is consent-first: we ask for your consent before we collect and use your personal data, we explain what we do with it, and you can withdraw your consent at any time, as described below.

1. The basis on which we use your data

We rely on your consent as the primary basis for collecting and using your personal data. You give this consent when you create an account and when you choose to turn on specific features — for example, when you allow access to your location.

For a limited set of activities, we also process personal data where it is necessary to provide the Service you have asked for — for example, to complete a booking, to bill you accurately, to keep you and our vehicles safe, to prevent fraud, or to meet a legal or regulatory obligation.

Some of this processing is essential to operating keyless car-sharing — for example, verifying that you are eligible to drive, and collecting vehicle and location data during a trip. If you choose not to provide this data, or you withdraw your consent, we may not be able to provide all or part of the Service.

You can withdraw your consent at any time (see "Your rights" below). Withdrawing your consent stops further optional and consent-based processing, and does not affect any processing we already carried out. However, some processing does not depend on your consent and will continue, and certain records will be kept, where this is necessary to bill you, to handle safety incidents, fraud, insurance or claims, or to meet a legal or regulatory obligation.

2. Information we collect

Account and contact information

Your name, email address, mobile number, and the credentials you use to sign in and authenticate.

Identity and driving-eligibility documents

To rent and drive shared vehicles, and to meet our insurance, safety and fraud-prevention requirements, we collect identity and driving-eligibility information, including your driver's licence and government-issued identification documents. Because these are sensitive documents, we treat them with particular care: we collect them only with your explicit consent, we use them only to verify that you are eligible to drive under the criteria set by our insurer and to prevent fraud, we restrict access to them, and we keep them only for as long as needed for verification and for our legal, insurance and fraud-prevention obligations.

Location information

With your permission, we collect precise device location to help you find nearby vehicles, to plan and navigate trips, and to operate features such as one-way zones. During an active trip, we collect location to provide live trip guidance and for safety.

Search and demand information

We record the destinations and map areas you search for within the app — for example, an address you enter or a region of the map you choose to look at — including searches that do not lead to a booking. We collect this with your consent and use it to operate the Service and to understand and plan for demand: where and when people want to travel, where to position vehicles, and where to expand. For our demand-planning and analytics, we work with this information in an aggregated or de-identified form wherever possible, so that it no longer identifies you.

Vehicle and trip information

When you use a VROOOM vehicle, our telematics service provider transmits vehicle and trip data to us, including trip details, vehicle status and location, and driving-behaviour information (such as mileage, and events relevant to safe driving like harsh braking, rapid acceleration, speed and collision events). We use this to deliver keyless access, operate and bill trips accurately, support safety and insurance, investigate incidents, prevent fraud, and improve the Service.

Payment information

Payments and subscriptions are processed through our payment service provider. Your full card details are provided directly to and handled by that provider; we retain only a tokenised reference (not your full card number) so that we can process subscription renewals and the future payments you authorise.

Usage and device information

Information about how you use the Service — such as searches, bookings, trips and in-app activity — together with device information (device and app identifiers, app version, and diagnostic data) used to operate, secure and improve the Service.

3. How we use your information

• To provide, operate and personalise the Service, including booking, unlocking and driving vehicles and related mobility features.
• To verify your identity and eligibility and to meet our insurance, safety and regulatory requirements.
• To process payments, subscriptions and any applicable fees or charges.
• To ensure safety, prevent and detect fraud or misuse, and handle incidents, damage or claims.
• To understand demand and usage patterns and to plan, maintain and improve the Service.
• To communicate with you about your account, trips, support requests and service updates.
• To comply with our legal and regulatory obligations.

4. How we share your information

We do not sell your personal data. We share it only as described below, and only with your consent or where it is necessary for the purposes set out in this policy:

• Service providers acting on our behalf, including mapping and location services (Google Maps Platform), our telematics service provider, our payment service provider, and our cloud hosting provider (Microsoft Azure). These parties may process your data only on our instructions and for the purposes set out in this policy, under a written agreement.
• Insurers and authorised partners, where necessary to provide vehicles, arrange insurance cover, or handle incidents and claims.
• Authorities and regulators, where we are required to do so by law or to protect the safety, rights or property of VROOOM, our users or the public.
• In a business transfer, such as a merger, acquisition or reorganisation, in which case we will take steps to ensure your data remains protected.

5. Where your data is stored and processed

Your personal data is primarily stored and processed within the State of Qatar, on Microsoft Azure infrastructure located in the Qatar region. For resilience and disaster recovery, a copy of certain data may also be held on Microsoft Azure infrastructure located in Europe. This means some of your data may be transferred to and processed outside Qatar.

Where this happens, we treat it as a cross-border transfer under Qatar's Personal Data Privacy Protection Law. This transfer is limited to what is necessary to keep the Service available, resilient and secure, takes place under contractual protections with our hosting provider, and we have assessed it as one that maintains the protection of your data and does not cause you serious harm.

6. How long we keep your data

We keep personal data for as long as needed to provide the Service to you, and after that only for as long as required to meet our legal, financial, insurance and regulatory obligations, after which it is deleted or anonymised. Identity and driving-eligibility documents are kept only for as long as needed for verification and for our related legal, insurance and fraud-prevention obligations.

7. How we protect your data and report incidents

We use technical and organisational measures designed to protect personal data, including encryption in transit and at rest, access controls, and restricting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your data and to respond appropriately to any incident.

If a personal data breach occurs that may cause serious harm, we will notify the competent authority — the National Cyber Security Agency / National Data Privacy Office — and, where appropriate, affected users, within 72 hours of becoming aware of it, in line with applicable Qatari data protection requirements.

8. Marketing communications

We send you marketing or promotional communications only if you have separately chosen to opt in to receiving them. This is separate from the service messages we send about your account and trips, which are part of providing the Service. You can withdraw your marketing consent or unsubscribe at any time, using the link in the message or by contacting us. Withdrawing marketing consent does not affect your account or your ability to use the Service.

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy of it;
• Request that we correct inaccurate or incomplete data;
• Request deletion of your data, or object to processing that is unnecessary, unfair or unlawful;
• Withdraw your consent at any time where our processing is based on consent (this will not affect processing carried out before withdrawal);
• Lodge a complaint with the competent data protection authority in the State of Qatar.

To exercise any of these rights, or to request deletion of your account and associated data, contact us at contact@vrooom.me. We aim to respond to your request within 30 days. Some data may be retained where we are legally required to keep it.

10. Children

The Service is intended for adults who hold a valid driving licence and are eligible to drive. It is not directed to anyone under the age of 18, and we do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can take appropriate action.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you within the Service. We encourage you to review this policy periodically.