Privacy Policy

1. Introduction and Who We Are

Welcome to the Powerlease Rider Scheduling Application (the "Application"), operated by [LEGAL ENTITY NAME], a company registered in the United Arab Emirates with company registration number [COMPANY REGISTRATION NUMBER], having its registered office at [REGISTERED ADDRESS] (hereinafter referred to as "Powerlease", "we", "us", or "our").

The Application is an internal workforce management platform available via web portal and mobile application (iOS and Android), designed exclusively for Powerlease employees, authorised contractors, and their supervisors and administrators ("Users").

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Application. By registering an account or using the Application, you confirm that you have read and understood this Privacy Policy.

If you have any questions, please contact our Data Protection Officer at [DPO EMAIL ADDRESS].

2. Information We Collect

2.1 Information You Provide Directly

• Full name
• Mobile phone number (used as your login identifier)
• Email address
• Profile photograph (optional)
• Employee ID or contractor identification number
• Vehicle/bike plate details: Authority/Emirate code (e.g., DXB), plate category code, and plate registration number
• Appointment details including issue category, issue type, preferred date and time

2.2 Information Collected Automatically

• Device information (device type, operating system, app version)
• Firebase Cloud Messaging (FCM) token for push notification delivery
• Login timestamps and session activity logs
• Appointment history and usage patterns within the Application

2.3 Vehicle and Fleet Data

Vehicle plate details submitted by Riders are validated against Powerlease's fleet records held in Microsoft Dynamics 365 Finance & Operations ("D365"). This data is used solely to verify that a Rider's registered vehicle is part of the Powerlease fleet.

2.4 What We Do Not Collect

We do not collect precise real-time GPS location data. The emirate/authority you select during plate registration is used only for fleet validation. We do not track your physical movements.

3. How We Use Your Information

• Service Delivery: To create and manage your account, enable appointment booking, assign mechanics, and manage the workshop queue.
• Fleet Verification: To validate your bike plate against Powerlease's fleet records and enable supervisors to approve or reject registrations.
• Push Notifications: To send appointment confirmations, reminders, status updates, and operational alerts via Firebase Cloud Messaging.
• Internal Operations: To allow supervisors and administrators to manage appointments, view rider profiles, assign mechanics, and generate reports.
• Security & Fraud Prevention: To detect, prevent, and respond to unauthorised access or misuse.
• Legal Compliance: To comply with applicable UAE laws and respond to lawful requests from authorities.
• Service Improvement: To monitor performance and improve functionality and user experience.

4. Legal Basis for Processing

Powerlease processes your personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and applicable implementing regulations. Our legal bases include:

• Contractual Necessity: Processing necessary for your employment or contractual relationship with Powerlease.
• Legitimate Interests: Processing for fleet management, operational efficiency, and workforce scheduling.
• Legal Obligation: Processing required to comply with applicable UAE laws.
• Consent: Where we rely on consent (e.g., push notifications), you may withdraw it at any time.

5. How We Share Your Information

5.1 Within the Application (Role-Based Access)

• Riders can view their own profile, bike registrations, and appointment history.
• Supervisors can view rider profiles, pending bike verifications, and appointment details.
• Mechanics can view their assigned appointments and relevant rider details.
• Administrators have broader access to manage all users, appointments, and settings.

5.2 Third-Party Service Providers

• Microsoft Corporation: Fleet data is validated against D365. Authentication may use Microsoft Azure AD. Microsoft processes data under its Data Processing Agreement.
• Google Firebase (Google LLC): FCM tokens are shared with Firebase to deliver push notifications.

5.3 Legal Disclosures

We may disclose personal data to government authorities, courts, or law enforcement where required by applicable UAE law.

5.4 No Sale of Data

We do not sell, rent, or trade your personal data to any third party for commercial or marketing purposes.

6. Data Retention

• Active accounts: Personal data is retained for the duration of your active employment or engagement with Powerlease.
• Appointment records: Retained for a minimum of [RETENTION PERIOD, e.g. 3 years] after the appointment date for audit purposes.
• Inactive accounts: Retained for [RETENTION PERIOD, e.g. 12 months] after deactivation before being deleted or anonymised.
• Device tokens: Retained until your account is deactivated or you uninstall the Application.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted data transmission using HTTPS/TLS protocols
• Password hashing — passwords are never stored in plain text
• Role-based access controls limiting data access to what is necessary per role
• Secure token-based authentication (JWT) with expiry mechanisms
• Regular review of access privileges and security configurations

If you suspect unauthorised access to your account, contact us immediately at [SUPPORT EMAIL ADDRESS].

8. Your Rights

Subject to the UAE PDPL, you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data (you can also update your profile directly in the Application).
• Erasure of your personal data, subject to legal obligations.
• Restrict processing in certain circumstances.
• Data portability — a copy of your data in a structured format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time (e.g., disable push notifications via device settings).

To exercise any of these rights, contact our Data Protection Officer at [DPO EMAIL ADDRESS]. We may verify your identity before actioning requests.

9. Push Notifications

The Application uses Firebase Cloud Messaging to send you appointment confirmations, reminders, status updates, and alerts. You may manage notification preferences through your device's operating system settings. Disabling notifications may affect your ability to receive timely appointment updates.

10. Children's Privacy

The Application is intended solely for adults (18 years of age or older) who are Powerlease employees or authorised contractors. We do not knowingly collect personal data from individuals under 18. If you believe a minor has provided data through the Application, contact us immediately.

11. International Data Transfers

Your personal data may be processed by our service providers (Microsoft and Google) outside the UAE. We ensure appropriate safeguards are in place, in accordance with the UAE PDPL, to maintain equivalent standards of data protection.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Application or other appropriate means, and the "Last Updated" date above will be revised accordingly. Your continued use of the Application after changes constitutes acceptance of the updated policy.

13. Contact Us and Grievance Officer

Data Protection Officer
[DPO NAME]
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
Email: [DPO EMAIL ADDRESS]
Phone: [DPO PHONE NUMBER]

Grievance Officer (escalated complaints)
[GRIEVANCE OFFICER NAME]
Email: [GRIEVANCE OFFICER EMAIL]

You also have the right to lodge a complaint with the UAE's competent data protection authority if you believe your rights have been violated.