Privacy Policy

1. Introduction

OOR Cabs Private Limited (“OOR Cabs”, “OOR”, “Company”, “we”, “us” or “our”) operates a technology-enabled mobility platform through which users may access transportation and related mobility services.

Our services may be accessed through the OOR Cabs mobile application, OOR Driver application, website, WhatsApp-based booking services and other digital channels operated or authorised by OOR.

We recognise that personal information entrusted to us is important and that the responsible handling and protection of such information is essential to maintaining the trust of our riders, drivers, employees, business partners and other users.

This Privacy Policy explains:

• what personal data OOR collects;
• how and why OOR collects and uses personal data;
• how personal data is shared;
• how location and device information is handled;
• how long personal data is retained;
• how personal data is protected;
• the rights available to individuals;
• how individuals may withdraw consent or make privacy-related requests; and
• how OOR addresses privacy complaints and data-security incidents.

This Privacy Policy applies to personal data collected through OOR’s applications, website, WhatsApp services and other authorised channels.

2. Applicable Legal and Regulatory Framework

OOR processes personal data in accordance with applicable Indian laws and regulations relating to information technology, privacy, cybersecurity and protection of personal data.

Depending on the nature of the processing and the applicable commencement dates, this includes, as applicable:

1. the Information Technology Act, 2000;
2. the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
3. the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent applicable to any activity or functionality of OOR;
4. the Digital Personal Data Protection Act, 2023;
5. the Digital Personal Data Protection Rules, 2025;
6. directions and requirements issued by the Indian Computer Emergency Response Team (CERT-In), where applicable; and
7. other applicable laws, regulations, governmental directions and regulatory requirements.

Where provisions of the applicable legal framework become effective at different times, OOR will implement and maintain its privacy and data-governance practices in accordance with the provisions applicable to the relevant processing activity.

Nothing in this Privacy Policy limits any rights available to an individual under applicable law.

3. Who This Policy Applies To

This Privacy Policy applies to individuals whose personal data is collected or processed by OOR, including:

3.1 Riders

Individuals who request, book or receive transportation services through OOR.

3.2 Drivers

Individuals who provide transportation services through OOR or through a transportation partner using the OOR platform.

3.3 Individuals whose information is provided by a user

For example, an emergency contact, referral contact or another person whose information is provided in connection with an OOR service. Where you provide another person’s personal data to OOR, you should do so only where you are authorised or otherwise permitted to provide that information.

4. Personal Data We Collect

The personal data collected by OOR depends upon the service used and the relationship between the individual and OOR.

4.1 Account and profile information

This may include:

• name;
• mobile number;
• email address;
• gender, where required;
• profile photograph;
• account credentials and authentication information;
• user preferences;
• emergency contact details; and
• other information required to create or maintain an account.

4.2 Driver and vehicle information

For drivers and transportation partners, this may include:

• driver’s name and contact details;
• photograph;
• driving licence information;
• identity/KYC documents;
• vehicle registration information;
• vehicle insurance information;
• permit and other vehicle-related documents;
• police verification/background verification information, where applicable;
• bank/payment details required for driver payments;
• driver ratings and service-performance information; and
• other information required for onboarding, verification, safety and regulatory compliance.

4.3 Location information

OOR may collect location information through the device used to access the OOR services.

For riders, location information may be used to:

• identify the pickup location;
• provide estimated arrival times;
• identify available vehicles;
• facilitate navigation and transportation;
• calculate distance and fares;
• provide ride tracking and safety features; and
• resolve service-related issues.

For drivers, location information may be used to:

• determine availability;
• identify nearby ride requests;
• match drivers with riders;
• display vehicle location to riders during relevant stages of a ride;
• support navigation;
• calculate ride distance and fares;
• monitor service availability;
• investigate complaints, fraud or safety incidents; and
• improve transportation operations.

Where background location access is required for driver operations, OOR will collect such information only for the purposes for which such access is required and subject to applicable permissions, notices and legal requirements.

OOR will endeavour to stop location collection when the relevant operational requirement has ended.

4.4 Ride and transaction information

This may include:

• ride requests;
• pickup and destination information;
• date and time of rides;
• distance travelled;
• route-related information;
• fare information;
• payment method;
• transaction reference;
• invoices and receipts;
• cancellation information;
• ratings and feedback; and
• other information relating to the use or provision of transportation services.

4.5 Payment information

OOR may process information necessary to facilitate payments, refunds and settlements.

Where payment processing is performed through third-party payment service providers, the relevant payment information may be processed by those providers in accordance with their applicable terms and privacy policies.

OOR will not unnecessarily retain complete payment-card information where such information is processed directly by an authorised payment service provider.

4.6 Device and technical information

Depending upon the service and permissions granted, OOR may collect:

• device type and model;
• operating system;
• application version;
• IP address;
• device identifiers;
• mobile network information;
• language and configuration information;
• crash reports;
• diagnostic information;
• advertising identifiers, where applicable; and
• technical logs necessary for security and service operation.

4.7 Communications information

Where users communicate through OOR’s platform, OOR may process information necessary to facilitate those communications.

This may include:

• date and time of communication;
• communication metadata;
• messages or other content where the platform provides such functionality;
• customer-support communications;
• call-related information; and
• information necessary to investigate complaints, disputes, safety incidents or fraudulent activity.

Where calls are recorded, OOR will provide appropriate notice and use recordings only for specified purposes such as customer support, quality monitoring, safety, dispute resolution, fraud prevention or legal compliance.

4.8 Information received from third parties

OOR may receive information from:

• transportation partners;
• payment service providers;
• identity/KYC verification providers;
• insurance providers;
• government or regulatory authorities;
• technology service providers;
• customer-support service providers; and
• other persons or organisations authorised to provide such information.

5. Purposes for Which OOR Uses Personal Data

OOR uses personal data only for specified and lawful purposes connected with its business and services. These purposes include:

5.1 Providing transportation services

To:

• create and maintain user accounts;
• receive and process ride requests;
• identify available drivers;
• match riders and drivers;
• provide pickup and destination services;
• provide navigation and ETA information;
• track rides;
• calculate fares;
• process payments;
• provide invoices and receipts; and
• complete the requested service.

5.2 Driver onboarding and management

To:

• verify driver identity;
• verify driving licences and vehicle documents;
• conduct legally permitted background verification;
• assess eligibility;
• activate and manage driver accounts;
• facilitate driver payments;
• monitor service performance;
• provide training and support; and
• comply with applicable transportation and regulatory requirements.

5.3 Safety and security

To:

• protect riders and drivers;
• verify identities;
• investigate safety incidents;
• detect unsafe or fraudulent activity;
• prevent unauthorised access;
• investigate complaints;
• investigate cancellation or payment fraud;
• protect OOR’s systems; and
• cooperate with law-enforcement and regulatory authorities where legally required.

5.4 Customer support

To:

• respond to customer enquiries;
• investigate complaints;
• resolve disputes;
• investigate lost-property claims;
• provide assistance during rides;
• improve customer support; and
• maintain records necessary for legitimate service and legal purposes.

5.5 Improving the OOR platform

OOR may use appropriately protected personal data and aggregated or anonymised information for:

• service improvement;
• operational analysis;
• product development;
• system testing;
• analytics;
• demand forecasting;
• safety improvements;
• fraud detection;
• artificial intelligence and machine-learning applications; and
• development of new mobility services.

Where personal data is not necessary for a particular analytical or research purpose, OOR will seek to use anonymised or aggregated information where reasonably practicable.

5.6 Legal and regulatory compliance

OOR may process and retain personal data where necessary to:

• comply with applicable laws;
• comply with court orders or lawful governmental requests;
• comply with regulatory requirements;
• establish, exercise or defend legal claims;
• investigate fraud;
• resolve disputes; or
• protect the rights and safety of OOR, its users or other persons.

5.7 Marketing and promotional communications

Subject to applicable law and required consent or other lawful basis, OOR may use personal data to communicate:

• offers;
• promotions;
• loyalty programmes;
• new services;
• surveys;
• events; and
• other OOR-related marketing communications.

Service-related communications, such as ride confirmations, OTPs, invoices, safety alerts and important account communications, are not treated as marketing communications.

Users may opt out of marketing communications through the mechanism provided by OOR, without affecting their ability to receive essential service communications.

6. Basis for Processing Personal Data

OOR will process personal data only where permitted under applicable law. Depending on the circumstances, processing may be based on:

• consent provided by the individual;
• processing necessary to provide a service requested by the individual;
• compliance with applicable law;
• compliance with lawful governmental or regulatory requirements;
• purposes expressly permitted under applicable data-protection law; or
• other legally permitted grounds.

Where consent is required, OOR will seek consent through an appropriate affirmative action and will provide information necessary for the individual to understand the purpose of the processing.

Consent for optional processing, such as marketing, will be distinguished from information required to provide the requested transportation service where required by law.

7. Privacy Notice and Consent

Where consent is required, OOR will provide an appropriate privacy notice before or at the time personal data is collected. The notice will, as applicable:

• identify the categories of personal data being collected;
• explain the specific purposes for which the data is processed;
• explain the service or functionality enabled by the processing;
• provide information regarding withdrawal of consent;
• provide information regarding applicable data-principal rights; and
• provide a mechanism for submitting privacy-related requests and complaints.

The detailed Privacy Policy will be available through the OOR application, website or other relevant digital channel.

OOR will not make consent for optional processing a condition for receiving a service where such processing is not necessary for providing that service, except where permitted by applicable law.

8. Withdrawal of Consent

Where processing is based on consent, an individual may withdraw consent through the mechanism provided by OOR.

Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Where withdrawal makes it impossible for OOR to provide a particular service or functionality that necessarily depends upon the relevant personal data, OOR may be unable to provide that service or functionality.

OOR will endeavour to make withdrawal of consent as straightforward as the process through which consent was provided, subject to applicable law and technical requirements.

9. Sharing of Personal Data

OOR does not sell personal data as a commercial commodity. Personal data may, however, be disclosed or made available where necessary for providing services, operating the platform, complying with law or protecting users and OOR. Categories of recipients may include:

9.1 Drivers and riders

Information necessary to complete a ride may be made available to the relevant driver or rider. For example, a driver may receive the rider’s pickup information and relevant destination information. A rider may receive relevant driver and vehicle information necessary to identify and complete the ride.

9.2 Service providers and Data Processors

OOR may engage third-party service providers for:

• cloud hosting;
• databases;
• maps and navigation;
• payment processing;
• OTP and communication services;
• WhatsApp services;
• customer support;
• analytics;
• cybersecurity;
• identity verification;
• insurance-related services;
• information technology services; and
• other operational requirements.

Such providers may process personal data only for authorised purposes and subject to applicable contractual and legal requirements.

9.3 Government and law-enforcement authorities

OOR may disclose information to government authorities, law-enforcement agencies, courts, regulators or other authorised bodies where required or permitted by law or pursuant to a valid legal process.

9.4 Corporate transactions

Personal data may be disclosed where necessary in connection with a merger, acquisition, investment, restructuring, sale of assets or similar corporate transaction, subject to applicable law and appropriate confidentiality protections.

10. Location Data

Location data is an important component of OOR’s mobility services. OOR may use location information to:

• identify nearby vehicles;
• match riders and drivers;
• provide pickup and destination services;
• calculate distance;
• determine fares;
• provide navigation;
• provide ETA;
• monitor active rides;
• provide safety features;
• investigate complaints and disputes;
• prevent fraud; and
• improve transportation operations.

Driver location may be processed while a driver is available to receive ride requests and during relevant stages of a ride.

Where continuous or background location is required for a driver-facing functionality, OOR will provide appropriate information regarding the purpose and nature of such collection and will seek required device permissions.

OOR will not use continuous location tracking for unrelated purposes merely because technical access to location is available.

11. Automated Processing and Algorithmic Systems

OOR may use automated systems and algorithms to support its services. These may include:

• driver-rider matching;
• availability determination;
• estimated arrival times;
• route and distance calculation;
• dynamic or demand-based pricing, where applicable;
• fraud detection;
• safety monitoring;
• service optimisation;
• demand forecasting;
• operational analytics; and
• personalised recommendations.

Automated systems may use factors such as:

• location;
• availability;
• distance;
• estimated travel time;
• ride demand;
• driver status;
• vehicle type;
• service history;
• ratings; and
• other relevant operational information.

Where automated processing results in a decision or action that is subject to a right of the individual under applicable law, OOR will provide the applicable mechanism for raising a concern, seeking review or exercising the relevant right.

12. Data Retention

OOR will retain personal data only for as long as reasonably necessary for the purpose for which it was collected or as required or permitted by applicable law. Retention periods may vary according to:

• the type of data;
• the purpose of processing;
• whether the user account remains active;
• legal and regulatory requirements;
• accounting and tax requirements;
• safety requirements;
• dispute resolution;
• fraud prevention;
• contractual requirements; and
• legal claims or proceedings.

OOR will maintain an internal data-retention schedule specifying appropriate retention periods for different categories of information.

When personal data is no longer required and there is no legal or legitimate requirement to retain it, OOR will delete, anonymise or securely dispose of the data in accordance with its internal procedures.

13. Account Deletion

Users may request closure or deletion of their OOR account through the mechanism provided by OOR. Upon receiving a valid deletion request, OOR will process the request in accordance with applicable law and its data-retention requirements.

Certain information may continue to be retained where necessary for:

• compliance with law;
• accounting and tax requirements;
• safety;
• fraud prevention;
• legal claims;
• dispute resolution;
• enforcement of contractual rights; or
• other purposes permitted or required by applicable law.

Where retention is no longer required, OOR will delete or anonymise the relevant information in accordance with its retention and deletion procedures.

14. Data Principal / User Rights

Subject to applicable law, individuals may have rights relating to their personal data, including:

14.1 Right to access information

An individual may request information regarding personal data processed by OOR and other information that OOR is required to provide under applicable law.

14.2 Right to correction and updating

Individuals may request correction or updating of inaccurate or incomplete personal information.

14.3 Right to erasure

Individuals may request deletion of personal data where permitted under applicable law.

14.4 Right to withdraw consent

Where processing is based on consent, individuals may withdraw such consent through the mechanism provided by OOR.

14.5 Right to grievance redressal

Individuals may raise privacy-related complaints with OOR through the designated grievance mechanism.

14.6 Right to nominate

Where applicable under the Digital Personal Data Protection Act, 2023, an individual may exercise the right to nominate another individual in accordance with the applicable procedure.

The exercise of these rights may be subject to lawful limitations and verification requirements.

15. Identity Verification for Privacy Requests

To protect personal data from unauthorised disclosure, OOR may require reasonable verification before processing a request relating to an account or personal data.

OOR will not require information that is unnecessary for verifying the identity of the person making the request.

16. Children’s Data

OOR’s transportation services are primarily intended for adults.

Where OOR knowingly processes personal data relating to children, it will comply with applicable legal requirements concerning children’s personal data.

OOR will not knowingly undertake processing prohibited under applicable law, including prohibited targeted advertising or tracking involving children where such restrictions apply.

17. Data Security

OOR implements reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• destruction;
• loss;
• misuse; and
• other forms of unlawful processing.

Depending on the nature of the information and the applicable system, security measures may include:

• encryption in transit;
• encryption or equivalent protection for stored information where appropriate;
• access controls;
• authentication mechanisms;
• role-based access;
• secure application development practices;
• server and database security;
• backups;
• monitoring and logging;
• vulnerability management;
• malware protection;
• employee confidentiality obligations;
• vendor security controls; and
• incident-response procedures.

No electronic system can be guaranteed to be completely secure. OOR will nevertheless continuously evaluate and improve its security safeguards based on technological developments and the nature of risks faced by the platform.

18. Personal Data Breaches and Cybersecurity Incidents

OOR maintains internal procedures for identifying, assessing, containing, investigating and responding to cybersecurity incidents and personal-data breaches.

Where a breach or cybersecurity incident occurs, OOR will take appropriate measures including, as applicable:

1. identifying and containing the incident;
2. assessing the nature and extent of the incident;
3. securing affected systems;
4. preserving relevant logs and evidence;
5. investigating the cause;
6. taking corrective and preventive measures;
7. notifying relevant authorities where required by law; and
8. notifying affected individuals where required by applicable law.

OOR will also comply with applicable CERT-In directions and incident-reporting requirements.

19. Cookies and Similar Technologies

OOR’s website and digital services may use cookies, SDKs, pixels and similar technologies for purposes including:

• authentication;
• security;
• service functionality;
• preferences;
• analytics;
• performance monitoring; and
• marketing, where applicable.

Where consent is legally required for a particular technology, OOR will provide an appropriate consent or preference mechanism.

20. Third-Party Services

OOR may integrate third-party services such as:

• mapping services;
• payment gateways;
• communication services;
• analytics services;
• cloud infrastructure;
• identity verification services; and
• other technology services.

Third-party services may have their own privacy policies and terms.

OOR will take reasonable steps to ensure that third-party processors engaged by OOR process personal data for authorised purposes and maintain appropriate safeguards, subject to applicable contractual and legal requirements.

21. Cross-Border Data Processing

OOR may use technology infrastructure or service providers that process or store personal data outside India, where permitted under applicable law.

Where personal data is transferred or processed outside India, OOR will comply with applicable legal and regulatory requirements relating to such transfer or processing.

Where the Government prescribes restrictions or requirements concerning transfers of personal data to specified countries or territories, OOR will comply with such requirements.

22. Data Processors and Vendor Management

OOR may appoint third parties to process personal data on its behalf. OOR will seek to ensure that relevant vendors:

• process data only for authorised purposes;
• maintain confidentiality;
• implement appropriate security safeguards;
• assist OOR in meeting applicable legal obligations where required;
• notify OOR of relevant security incidents; and
• return, delete or securely dispose of information when no longer required, subject to applicable legal requirements.

OOR will maintain appropriate contractual and operational controls for material data-processing relationships.

23. Grievance Redressal and Privacy Contact

OOR has established a mechanism through which users may raise privacy and personal-data related complaints.

Users may contact OOR regarding:

• access requests;
• correction or updating;
• deletion requests;
• withdrawal of consent;
• privacy complaints;
• unauthorised use of personal data;
• data-security concerns; and
• other privacy-related matters.

OOR will acknowledge and process such requests in accordance with applicable law and its internal procedures.

24. Law Enforcement and Government Requests

OOR may disclose personal data where required by a valid legal process or where disclosure is otherwise authorised or required by applicable law.

Where legally permitted, OOR will assess such requests and disclose only information reasonably required for the relevant purpose.

25. Changes to This Privacy Policy

OOR may periodically update this Privacy Policy to reflect:

• changes in services;
• changes in technology;
• changes in applicable law;
• changes in data-processing practices; or
• improvements to OOR’s privacy and security practices.

Where required by applicable law, OOR will provide notice of material changes through the OOR application, website, email, SMS, WhatsApp or other appropriate communication channels.

The updated policy will specify the effective date.

26. Contact Information

27. Governing Principle

OOR’s objective is to provide technology-enabled mobility services while respecting the privacy and security of the individuals whose information is entrusted to the Company. OOR will seek to follow the principles of:

• transparency;
• purpose limitation;
• data minimisation;
• appropriate consent;
• security;
• accountability;
• responsible data sharing;
• appropriate retention;
• user control; and
• lawful processing.

This Privacy Policy should be read together with OOR’s Terms of Use, Driver Terms, applicable consent notices and other policies governing the use of OOR’s services.