Privacy Policy – Labby — Rides across Damascus

Effective Date: August 5, 2026

Introduction

Labby welcomes you and appreciates your trust when using our application and services. We are committed to protecting the privacy of our users and handling their personal data responsibly and transparently, as this is an essential part of providing reliable and secure digital transportation services.

This Privacy Policy explains how the company collects, uses, stores, shares, and protects personal data, as well as the rights users have regarding their personal data when using the Labby application or any of its related services or digital platforms.

This policy applies to all individuals who interact with the company or use its services, including passengers, transportation service providers, job applicants, company employees to the extent that the data relates to their employment relationship, as well as visitors to the website or any other digital channels operated by the company.

This policy also applies to all personal data collected through the Labby application, website, official communication channels, customer support services, or any other means adopted by the company to provide its services.

Personal data refers to any information that can directly or indirectly identify a natural person, whether independently or when combined with other information.

Acceptance of This Policy

By using the Labby application or any services provided by the company, you acknowledge that you:

Have read this Privacy Policy in full.
Understand how the company handles your personal data.
Agree to the collection, use, and processing of your personal data in accordance with this policy and applicable laws and regulations.

If you do not agree with any provision of this policy, you must stop using the application and the services associated with it.

Where applicable laws require obtaining explicit consent for processing a specific type of data or using it for a particular purpose, the company will obtain such consent separately before beginning that processing.

Who We Are

Labby is a digital application and platform designed to facilitate transportation service requests by connecting users with transportation service providers through electronic technologies that enable users to request, manage, track, and complete rides in a more efficient and convenient manner.

The company operates the application, manages the technical infrastructure required to provide the services, improves user experience, supports payment and communication processes, provides customer service, and implements the necessary measures to protect the platform and its users.

The company’s responsibility is not limited to operating the application; it also includes managing the personal data necessary to provide services while committing to implementing appropriate technical and organizational measures to maintain the security and confidentiality of such data and prevent any unauthorized use.

Scope of This Privacy Policy

This policy applies to all processes involving the collection, use, storage, sharing, retention, or deletion of personal data carried out through:

The Labby mobile application.
The official website.
Customer service centers.
Official communication channels operated by the company.
Technical support services.
Any other digital services or platforms operated by the company or through which its services are provided.

This policy also applies to all personal data processed during the use of transportation services, registration on the application, communication with the company, or participation in any services, programs, or campaigns organized by the company.

This policy does not apply to websites, applications, or services operated by third parties, even if access to them is provided through links within the Labby application. The use of such services is subject to the privacy policies of their respective operators.

Principles We Follow When Processing Data

The company ensures that all personal data processing activities are carried out according to principles that respect users’ privacy and protect their rights. These principles include:

First: Lawfulness and Transparency

Personal data is processed in lawful, clear, and transparent ways, while providing users with the necessary information to understand how their data is used.

Second: Purpose Limitation

Personal data is collected only for specific and legitimate purposes related to providing services, operating the application, or fulfilling legal obligations. The data will not later be used for purposes incompatible with those purposes unless permitted by law or after obtaining the required consent.

Third: Data Minimization

The company strives to collect only the minimum amount of data necessary to achieve the intended purpose and avoids requesting or retaining information that is not related to providing services or operating the platform.

Fourth: Data Accuracy

The company seeks to maintain accurate and updated personal data whenever possible and encourages users to review their information and notify the company of any changes.

Fifth: Information Security

The company commits to applying appropriate technical and organizational measures to protect personal data from unauthorized access, unlawful use, loss, alteration, or destruction.

Sixth: Storage Limitation

Personal data is not retained for longer than necessary to achieve the purpose for which it was collected or for the period required by legal or regulatory obligations. After that, the data will be deleted or anonymized securely whenever possible.

Seventh: Accountability

The company regularly reviews its data protection practices and takes the necessary measures to ensure compliance with this policy and any relevant legal or regulatory requirements.

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below unless the context requires otherwise:

Company:
The entity that owns and operates the Labby application, responsible for operating the platform, managing services, and processing personal data in accordance with this policy.

Labby or the Application:
The Labby digital platform, including mobile applications, the website, and any other electronic services or platforms operated by the company.

User:
Any person who uses the application or any of its services, whether as a passenger, service provider, visitor, job applicant, or in any other capacity that allows interaction with the company’s services.

Passenger:
A person who uses the application to request transportation services or any other services provided by the company through the platform.

Service Provider (Driver):
A natural or legal person approved by the company to join the platform and provide transportation services or any other services made available through the application in accordance with applicable regulations and company policies.

Personal Data:
Any information relating to an identified or identifiable natural person, whether directly or indirectly, either through that information alone or when combined with other information.

Data Processing:
Any operation or set of operations performed on personal data by any means, whether electronic or manual, including collecting, recording, organizing, storing, modifying, using, sharing, transferring, restricting, deleting, or destroying data.

Services:
All services made available by the company through the Labby application, including transportation services, supporting services, and any future services added to the platform.

Third-Party Service Provider:
Any external entity that cooperates with the company to provide technical, operational, financial, legal, consulting, or other services related to operating the platform.

Technical Data:
Information collected automatically about devices and systems used to access the application, such as device type, operating system, application version, Internet Protocol (IP) address, device identifiers, and error logs.

Personal Data We Collect

The nature of the data collected by the company depends on the type of service used and the way the user interacts with the application. The company aims to collect only the minimum data necessary to provide its services efficiently and securely.

First: Account Creation Data

When creating an account on the Labby application, we may request certain basic information, which may include:

Full name.
Mobile phone number.
Email address (if available).
Password (stored in an encrypted and unreadable format).
Preferred language.
City or area of use, when required.

We may use the phone number as the primary method for identity verification, communication with the user, and account management.

Second: Ride Data

When using transportation services, we may collect information related to each ride, including:

Pick-up location.
Requested destination.
Ride request time.
Ride acceptance, start, and completion times.
Distance traveled.
Ride duration.
Fare amount.
Payment method used.
Ride status (completed, cancelled, or otherwise).
User ratings or feedback related to the ride.

This data is used to provide the service, improve user experience, handle complaints, and ensure service quality.

Third: Location Data

The Labby application relies on location services to provide transportation services effectively.

Therefore, we may collect location data where permitted by your device settings, including:

Current location while using the application.
Pick-up location.
Drop-off location.
Ride route, when necessary.
GPS data during active rides.

Location data is used only for purposes related to providing the service, improving location accuracy, enhancing user safety, or for other purposes described in this policy.

Fourth: Transportation Service Provider (Driver) Data

In addition to basic account information, transportation service providers may be required to provide additional data necessary to complete registration and verification procedures, such as:

Personal identification documents or official documents.
Driver’s license.
Vehicle information.
Vehicle registration certificate.
Insurance documents, where applicable.
Personal photo.
Photos or documents required for identity verification.
Any other documents required by applicable regulations or company policies.

This information may be updated periodically to ensure that the service provider remains eligible to use the platform.

Fifth: Payment Data

When using electronic payment methods, the data required to complete financial transactions may be processed, including:

Payment method details.
Transaction amounts.
Payment status.
Payment and refund records.

The company does not retain payment card details except to the extent permitted by applicable regulations and security standards. Such data may be processed through approved payment service providers.

Sixth: Technical Data and Usage Data

The application automatically collects certain technical information when it is used, which may include:

Internet Protocol (IP) address.
Device type.
Device manufacturer.
Operating system and version.
Application version.
Time zone.
Device identifiers.
Network connection data.
Crash and technical error logs.
Performance information.

We may also collect information about how the application is used, such as:

Pages visited.
Features used.
Duration of application usage.
Number of logins.
Interaction with notifications.
Usage preferences.

This data helps us improve application performance, identify technical issues, and enhance user experience.

Seventh: Communication Data with the Company

When contacting customer service or submitting inquiries, complaints, or suggestions, we may collect related information, such as:

Contact details.
Contents of messages or communications.
Voice recordings of calls, where users are notified of such recording or where permitted by applicable regulations.
Attachments or documents submitted by the user.
Actions taken by the company to address the request.

Eighth: Data Voluntarily Provided by Users

Users may choose to provide the company with additional information that is not required, whether while using the application, communicating with the company, participating in surveys, campaigns, or various programs.

Such data is processed according to the purposes for which it was collected and in accordance with this policy.

Ninth: Job Applicant Data

If an individual applies for employment with the company, we may collect the data necessary to evaluate the application, such as:

Curriculum vitae (CV).
Educational qualifications.
Professional experience.
Contact details.
Interview results.
Any documents or information the applicant chooses to provide during the recruitment process.

This data is used solely for recruitment purposes and managing the selection process unless the applicant agrees to retain it for consideration of future employment opportunities.

How We Collect Personal Data

Labby is committed to collecting personal data through lawful and transparent methods and only to the extent necessary to provide its services and operate its platform efficiently.

Data may be collected from several sources depending on how you use the application and services.

First: Data Provided Directly by You

We may collect data that you provide when you:

Create a new account or update your account information.
Register as a service provider.
Complete identity verification procedures.
Request a ride or use one of the application services.
Contact customer service or technical support.
Submit complaints, feedback, or suggestions.
Participate in surveys, campaigns, or offers organized by the company.
Apply for employment or join the company’s team.

The user is responsible for ensuring the accuracy of the information provided and must notify the company of any significant changes to such data.

Second: Automatically Collected Data

When using the Labby application, certain information may be collected automatically by the application, operating systems, or devices used, including:

Device and operating system information.
Internet Protocol (IP) address.
Device identifiers.
Network connection data.
Performance and error data.
Application usage data.
Location data, if location services are enabled and permission has been granted by the user.

This data helps the company operate the application, improve performance, identify technical issues, and enhance platform security.

Third: Data Obtained from Other Parties

The company may receive user data from external parties when necessary to provide services or fulfill legal obligations, including for example:

Electronic payment service providers.
Identity verification service providers.
Technology service partners.
Government or regulatory authorities, where disclosure or obtaining such data is permitted or required by law.
Entities authorized by the user or permitted by the user to share their data with the company.

The company processes such data in accordance with this policy and applicable laws.

Legal Basis for Processing Personal Data

Labby processes personal data based on one or more legal grounds permitted under applicable laws, depending on the nature of the service and the purpose of processing.

These legal grounds may include:

Contract Performance

Data is processed when necessary to establish or perform the contractual relationship with the user, such as creating accounts, managing rides, processing payments, and providing support services.

User Consent

Where applicable regulations require prior consent, the company relies on user consent before collecting or using personal data.

Users may withdraw their consent at any time where permitted, without affecting the lawfulness of processing carried out before withdrawal.

Legal Obligations

The company may process certain data to comply with legal or regulatory obligations, implement decisions or orders issued by competent authorities, or fulfill requirements related to accounting, auditing, fraud prevention, or other legal obligations.

Legitimate Interests

The company may process certain data where necessary to achieve legitimate interests, provided that such interests do not override users’ fundamental rights and freedoms.

These interests may include, for example:

Improving service quality.
Developing the application.
Enhancing platform security.
Detecting unlawful or fraudulent activities.
Protecting the rights of the company and its users.
Analyzing performance and measuring service quality.

Protection of Vital Interests or Safety and Security

Data may be processed where necessary to protect the safety of users, service providers, or any other person, or to respond to emergencies, incidents, or circumstances that may threaten individuals or property.

Other Purposes Permitted by Law

The company may process personal data in any other cases permitted by applicable laws, regulations, or regulatory decisions, to the extent necessary and for purposes authorized by such laws.

Purposes of Processing Personal Data

Labby processes personal data only to the extent necessary to provide its services, operate, and improve its platform. Data is processed only for legitimate purposes consistent with the nature of the services provided by the company or required by applicable laws.

The purposes of processing personal data include, but are not limited to:

First: Account Creation and Management

The company uses necessary personal data to create user accounts, verify identities, and manage accounts throughout the period of application use, including:

Creating and activating accounts.
Verifying ownership of phone numbers or email addresses.
Updating user information.
Recovering accounts when necessary.
Managing account settings and user preferences.
Processing account closure or deletion requests.

Second: Providing Transportation Services

Personal data is processed to enable the company to operate and manage transportation services efficiently, including:

Receiving ride requests.
Matching passengers with service providers.
Identifying pick-up and drop-off locations.
Tracking ride status in real time.
Calculating ride costs.
Sending ride-related notifications.
Managing cancellations or modifications.
Providing support during or after rides.

Third: Identity and Eligibility Verification

The company may process certain data to verify the identity of users or service providers and confirm their eligibility to use the platform. This includes reviewing official documents, verifying the accuracy of submitted information, and carrying out identity verification procedures when necessary.

This aims to protect users, enhance platform reliability, and prevent identity fraud or misuse of services.

Fourth: Payment Processing and Financial Transactions

The company processes the data necessary to complete payments and manage financial transactions related to the services, including:

Collecting ride fares.
Processing electronic payments.
Handling refunds or settlements.
Issuing financial records or notifications.
Detecting unusual or suspicious financial activities.

Some processing activities may be carried out in cooperation with approved payment service providers in accordance with applicable security standards.

Fifth: Communication with Users

The company may use users’ contact information to communicate with them regarding services, including:

Confirming registration or login activities.
Sending ride-related notifications.
Responding to inquiries and complaints.
Handling technical support requests.
Sending account security alerts.
Notifying users about important updates affecting services or this policy.

Sixth: Improving Services and Developing the Platform

The company uses personal data and technical data to analyze application performance and understand how users interact with the platform, helping us to:

Improve user experience.
Develop new features and functionalities.
Enhance application speed and stability.
Resolve technical issues.
Measure service quality.
Improve the accuracy of matching systems between passengers and service providers.
Develop new solutions and technologies that improve platform efficiency.

Where appropriate, the company seeks to use aggregated or anonymized data for analytical and statistical purposes.

Seventh: Security and Fraud Prevention

Protecting the platform and its users is one of the company’s highest priorities. Therefore, personal data may be processed for the purposes of:

Detecting unlawful activities.
Preventing misuse of the application.
Identifying suspicious transactions or activities.
Protecting accounts from unauthorized access.
Investigating complaints or security incidents.
Protecting the rights of the company, users, and service providers.

The company may also use analytical technologies to detect unusual patterns that may indicate attempted fraud or misuse.

Eighth: Compliance with Legal and Regulatory Obligations

The company may process personal data to fulfill obligations imposed by applicable laws or competent authorities, including:

Maintaining legally required records.
Responding to requests or orders issued by competent authorities.
Cooperating with judicial or regulatory authorities.
Fulfilling obligations related to accounting, auditing, fraud prevention, or anti-money laundering where applicable.

Ninth: Marketing and Promotional Communications

The company may use users’ contact information to send information related to services, features, offers, or marketing campaigns, in accordance with applicable laws or based on user consent where required.

Users may unsubscribe from marketing communications at any time through the methods provided by the company, without affecting the receipt of essential notifications related to accounts, rides, or service security.

Tenth: Recruitment and Human Resources Management

If an individual applies for employment with the company or joins the company, their personal data may be processed to manage recruitment procedures or the employment relationship, including:

Reviewing job applications.
Evaluating candidates.
Entering into employment contracts.
Managing salaries and benefits.
Fulfilling employee-related legal obligations.
Managing performance, training, and administrative affairs.

Eleventh: Other Legitimate Purposes

The company may process personal data for any other purpose that is compatible with the purpose for which the data was collected, or where permitted by applicable laws or based on user consent, as applicable.

In all cases, the company commits not to use personal data for purposes that conflict with this policy or users’ legal rights.

Sharing and Disclosure of Personal Data

Labby is committed not to sell, rent, or disclose personal data to any third party except to the extent necessary to provide services, operate the platform, fulfill legal obligations, or in other cases permitted under applicable laws.

Disclosure of data is limited to the minimum necessary to achieve the intended purpose, while implementing appropriate measures to protect data confidentiality and security.

Personal data may be shared with the following categories:

First: Between Passengers and Transportation Service Providers

To enable the completion of rides, certain basic information may be exchanged between passengers and service providers, such as:

First name or displayed name in the application.
Contact number, when necessary or through communication methods provided by the application.
Pick-up location.
Destination, where applicable.
Ride details.
Ride ratings, within the limits established by the company.

The use of this information is limited to completing the Ride or related communication. It may not be used for any other purpose that violates applicable laws or the application’s terms of use.

Second: Technology Service Providers

The company may cooperate with external parties that provide technical or operational services supporting the operation of the application, such as:

Hosting and cloud computing services.
Data storage services.
SMS, email, and notification delivery services.
Maps and location services.
Performance monitoring and error analysis services.
Information security and system protection services.

These providers are only permitted to process personal data to the extent necessary to provide the agreed services and in accordance with the company’s instructions and contractual confidentiality obligations.

Third: Payment Service Providers

When electronic payment methods are used, necessary data may be shared with payment service providers, financial institutions, or relevant entities involved in completing financial transactions.

Such processing is carried out according to applicable security standards, and the data is used only for purposes related to payment processing, settlement, refunds, or compliance with legal requirements.

Fourth: Affiliates and Partners

If the company is part of a group of companies or works with partners providing supporting services, certain personal data may be shared to the extent necessary to support platform operations, develop services, or provide shared services, while maintaining an appropriate level of data protection.

Fifth: Advisors and Professional Service Providers

Personal data may be disclosed, where necessary, to legal advisors, financial advisors, accountants, auditors, insurance companies, or other professional service providers who require such data to perform their assigned duties, subject to confidentiality and data protection obligations.

Sixth: Government Authorities and Competent Bodies

The company may disclose personal data where required by applicable laws or in response to requests issued by competent judicial, regulatory, or security authorities, or where disclosure is necessary to:

Fulfill a legal obligation.
Protect rights or property.
Prevent or investigate crimes, fraud, or misuse of the platform.
Protect the safety of users, service providers, or any other person.

Disclosure in such cases is limited to the data necessary to achieve the required purpose.

Seventh: Corporate Transactions

If the company undergoes a merger, acquisition, restructuring, sale of all or part of its assets, or any similar transaction, personal data may be transferred to the successor entity or acquiring party, provided that such party continues to protect personal data in accordance with this policy or applicable laws.

Users will be notified, where required or appropriate, of any material changes affecting the processing of their personal data resulting from such transactions.

Eighth: With User Consent

The company may share personal data with any other party if it obtains user consent or based on the user’s explicit request or authorization, within the limits covered by such consent or authorization.

Transfer of Data Outside the Country

As part of operating its services, the company may rely on service providers or technical infrastructure whose servers or data centers are located inside or outside the country.

If operating the application or providing services requires transferring, storing, or processing personal data outside the country, the company commits to implementing appropriate measures to ensure that an adequate level of protection for personal data continues to be provided, in accordance with applicable laws and recognized best practices.

Such measures may include, depending on the circumstances:

Entering into contractual agreements requiring recipient parties to protect personal data.
Imposing confidentiality and information security obligations.
Applying appropriate technical and organizational safeguards to protect data during transfer or storage.
Restricting access to data to authorized individuals only and for legitimate purposes.

The company will not transfer personal data if such transfer would expose users’ rights or privacy to risk, unless permitted by applicable laws or carried out with appropriate safeguards.

Third-Party Links and Services

The Labby application or its website may contain links to, or integrate services or tools provided by, third parties that are not managed by the company.

This Privacy Policy does not apply to such websites, applications, or services, and the company is not responsible for the privacy practices or content of those third parties.

The company recommends that users review the privacy policies of any third-party website or service before providing any personal data or using their services.

Retention of Personal Data

Labby retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal, regulatory, or contractual obligations, or protect the legitimate rights of the company or its users.

Once the purpose for retaining the data has been fulfilled, or the retention period required by applicable laws has expired, the company will securely delete, destroy, or anonymize the data so that it can no longer be used to identify any individual, unless retention is required or permitted by law.

Retention periods may vary depending on the nature of the data and the purpose of processing. For example:

Account Data: Retained for as long as the account remains active and for a reasonable period after account closure where necessary to resolve disputes or comply with legal requirements.
Ride and Transaction Data: Retained to the extent necessary for service management, handling claims, and fulfilling financial, tax, or accounting obligations.
Customer Support and Complaint Data: Retained until the relevant request or complaint has been resolved and may be retained for an additional period where necessary for documentation or service quality improvement purposes.
Marketing Data: Retained until the user withdraws consent or opts out of receiving marketing communications, unless a longer retention period is required by law.
Job Applicant Data: Retained throughout the recruitment process and may be retained for an additional period if the applicant consents to consideration for future employment opportunities.

The company periodically reviews stored data to ensure that no personal data is retained longer than is legitimately necessary.

Data Protection and Information Security

Labby is committed to implementing appropriate technical and organizational measures to protect personal data against unauthorized access, unlawful use, disclosure, alteration, loss, or destruction.

To achieve this, the company implements security measures proportionate to the nature of the data and potential risks, including, without limitation:

Encrypting data during transmission and storage where appropriate.
Applying access control measures so that personal data is accessible only to authorized individuals whose job responsibilities require such access.
Using authentication and identity verification mechanisms to protect accounts and systems.
Monitoring systems and technical infrastructure to detect unauthorized access attempts or unusual activities.
Conducting periodic security assessments and reviews to evaluate and improve the effectiveness of security controls.
Maintaining logs of activities related to data access where appropriate.
Training employees and collaborators on best practices for data protection and confidentiality.
Requiring employees and external service providers to comply with confidentiality obligations regarding personal data.

Despite these measures, no method of transmitting or storing data electronically can be guaranteed to be completely secure. Therefore, while the company cannot guarantee absolute security against all risks, it is committed to taking all reasonable measures to minimize such risks and respond appropriately if they occur.

Users’ Rights Regarding Personal Data

Labby believes that users should be able to understand how their personal data is used and exercise control over it within the limits permitted by applicable laws.

Accordingly, users have a range of rights relating to their personal data, which may be exercised by contacting the company through the channels specified in this Privacy Policy.

Before processing any request relating to personal data, the company may request additional information to verify the identity of the requester in order to protect personal data and prevent unauthorized access, modification, or deletion.

Users’ rights include the following:

First: Right to Know How Data Is Processed

Users have the right to obtain information regarding how the company processes their personal data, including:

The types of data collected.
The purposes for collecting and using the data.
The parties with whom the data may be shared.
The applicable data retention periods.
The measures taken to protect the data.

This information is provided through this Privacy Policy, and users may contact the company for any additional clarification.

Second: Right of Access

Users have the right to request access to the personal data held by the company about them and obtain information regarding:

The personal data being processed.
The purposes of processing.
The source from which the data was obtained, where available.
The parties with whom the data has been shared, where applicable.

After verifying the user’s identity and reviewing the request, the company will provide the requested information in accordance with applicable laws and procedures.

Third: Right to Rectification

Users have the right to request the correction or updating of inaccurate, incomplete, or outdated personal data.

Where available, users may also update certain account information directly through the application.

The company encourages users to keep their information accurate, as accurate information enables more efficient and secure services.

Fourth: Right to Erasure

Users may request the deletion of their personal data where:

The data is no longer necessary for the purpose for which it was collected.
The user wishes to close their account and there are no legal or operational reasons requiring the company to retain the data.
The data was collected based on the user’s consent, the consent has been withdrawn, and no other legal basis exists for retaining the data.

However, the company may retain certain data for a specified period where necessary to comply with legal obligations, resolve ongoing disputes, or protect the rights of the company or its users.

Fifth: Right to Restrict Processing

Users may request the restriction of the processing of their personal data in certain circumstances, including:

Where the accuracy of the data is contested pending verification.
Where the user objects to a particular processing activity.
Where the data must be retained for the establishment, exercise, or defense of legal claims.

If a restriction request is approved, the company will limit the use of the data except where otherwise permitted by applicable laws or with the user’s consent.

Sixth: Right to Object to Processing

Users may object to certain processing activities involving their personal data, particularly where processing is based on the company’s legitimate interests or where personal data is used for direct marketing purposes.

Upon receiving a valid objection, the company will review the request and take appropriate action in accordance with applicable laws.

Seventh: Right to Withdraw Consent

Where the processing of personal data is based on user consent, users may withdraw that consent at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. However, withdrawing consent may result in certain services or features becoming unavailable where they depend on the relevant data.

Eighth: Right to Obtain or Transfer Personal Data

Where permitted by applicable laws, users may request a copy of the personal data they have provided to the company or request that such data be transferred to another party in an appropriate format, where technically and legally feasible.

Ninth: Right to Lodge a Complaint

If a user believes that the company has not handled their personal data in accordance with this Privacy Policy or applicable laws, the user has the right to:

Contact the company directly in an attempt to resolve the issue.
Submit a complaint to the relevant regulatory or supervisory authority in accordance with applicable procedures.

The company encourages users to contact it first so that it can understand the issue and take appropriate measures to resolve it.

How to Exercise Your Rights

To exercise any of your rights relating to your personal data, you may contact the company through the official contact channels provided at the end of this Privacy Policy.

When submitting a request, we may ask you to provide information that enables us to verify your identity in order to protect your personal data and prevent unauthorized requests.

The company reviews and responds to requests within the timeframes prescribed by applicable laws or within a reasonable period, depending on the nature and complexity of the request.

In certain circumstances, the company may be unable to fulfill a request in full where doing so would conflict with legal or regulatory obligations or adversely affect the rights or privacy of other individuals. Where applicable, the company will explain the reasons for its decision.

Cookies and Tracking Technologies

Labby uses cookies and similar technologies to improve application performance and provide a more efficient user experience.

Cookies are small files stored on a user’s device when using certain digital services. They help remember certain information related to the user’s interaction with the service.

The company may use these technologies for the following purposes:

First: Essential Cookies

These cookies are necessary for operating the application and providing its core functionality, including:

Maintaining user login sessions.
Enhancing account security.
Remembering essential settings.

These cookies generally cannot be disabled because they are necessary for the operation of the service.

Second: Analytics and Performance Cookies

These cookies help the company understand how the application is used and improve its performance by enabling us to:

Identify the pages or features most frequently used.
Analyze technical errors and system issues.
Measure application performance.

Third: Marketing and Personalization Cookies

The company may use cookies and similar technologies to provide users with more relevant content or offers, subject to the consents required under applicable laws.

Users may control certain cookie settings through their device or application settings. However, disabling certain technologies may affect the availability of certain features or the quality of the user experience.

Security Incident Management and Data Breach Notification

The company maintains internal procedures designed to detect, respond to, and mitigate security incidents in order to protect personal data and ensure the continuity of its services.

If a security incident results in, or may result in, unauthorized access to, loss of, alteration of, or unlawful disclosure of personal data, the company will take appropriate measures to assess the incident, contain it, and mitigate its effects.

Where a security incident is likely to materially affect users’ rights or privacy, or where notification is required under applicable laws, the company may take one or more of the following actions, depending on the nature of the incident:

Notify affected users, where practicable.
Provide users with available information regarding the nature of the incident and its potential consequences.
Explain the measures taken by the company to address the incident and mitigate its effects.
Provide appropriate recommendations to help users protect their accounts or personal data, where necessary.
Notify the relevant competent authorities where required by applicable laws or regulations.

The company regularly reviews security incidents to identify lessons learned, improve its security controls and procedures, and reduce the likelihood of similar incidents occurring in the future.

User Responsibilities for Protecting Personal Data

In addition to the measures implemented by the company to protect personal data, users are responsible for maintaining the security of their accounts and personal information while using the application.

Accordingly, users are expected to:

Keep their login credentials confidential and not share them with anyone.
Choose a strong password and update it whenever necessary.
Sign out of their account when using shared devices.
Maintain the security of the device used to access the application.
Keep their personal information accurate and up to date whenever changes occur.
Notify the company without undue delay if they suspect that their account has been compromised, used without authorization, or that their login credentials have been lost.

The company will never ask users to disclose their account password by telephone, email, text message, or any other communication method. Any such request should be ignored and reported to the company immediately as a potential fraudulent attempt.

The company shall not be liable for any damage resulting from a user’s failure to safeguard the confidentiality of their login credentials or from using the application in violation of the Terms of Use or the company’s security instructions.

Children’s Privacy

Labby’s services are intended for individuals who have the legal capacity to use transportation services under applicable laws.

The company does not knowingly collect personal data from children or individuals who are not legally eligible to use the services.

Where Labby’s services are used on behalf of a minor, the user represents and warrants that they have the legal authority to provide any required information and to use the services on the minor’s behalf, and they assume responsibility for ensuring the lawfulness of such use.

If the company becomes aware that it has unintentionally collected personal data relating to a minor without an appropriate legal basis, it will take reasonable steps to delete such data or otherwise handle it in accordance with applicable legal requirements.

The company also encourages parents and legal guardians to supervise minors’ use of devices and digital services and to ensure that no personal data is shared without appropriate authorization.

Changes to This Privacy Policy

Labby may update this Privacy Policy from time to time to reflect:

Changes to the services we provide.
Technical or operational developments.
Amendments to applicable laws or regulatory requirements.
Improvements to the ways we collect, use, or protect personal data.

Whenever this Privacy Policy is updated, the “Last Updated” date shown at the beginning of this document will be revised accordingly.

Where changes are material or significantly affect users’ rights or the way their personal data is processed, the company may notify users through appropriate channels, including:

An in-app notification.
SMS or any other available communication method.

To the extent permitted by applicable laws, continued use of the Labby application after the publication of updates constitutes acceptance of the revised Privacy Policy.

Contact Us

If you have any questions, requests, or comments regarding this Privacy Policy or the manner in which Labby processes your personal data, you may contact us through the official communication channels available within the application or on our website.

You may also contact us to:

Exercise any of your rights relating to personal data.
Request clarification regarding the use of your personal data.
Submit a privacy-related complaint or comment.
Report any security concerns or unauthorized use of your account.

We will review all requests and inquiries and handle them in accordance with our internal procedures and applicable laws.

Contact Details:

Owner and Operator of the Labby Application:

NEW BARADA TECH SERVICES LLC

Registration No| 23536

Address:

Damasus – Syrian Arab Republic

[email protected]

General Provisions

Arabic Version Prevails

If this Privacy Policy is made available in more than one language, the Arabic version shall prevail as the governing version within Arab countries unless otherwise required by applicable laws or governing agreements.

No Additional Contractual Rights

This Privacy Policy is not intended to create any contractual rights or obligations between the company and the user beyond those established under applicable laws or the application’s Terms of Use.

Severability

If any provision of this Privacy Policy is found to be unenforceable or inconsistent with applicable laws, such provision shall not affect the validity or enforceability of the remaining provisions, which shall remain in full force and effect.

Compliance with Applicable Laws

Labby is committed to processing personal data in accordance with applicable laws, regulations, and official instructions, and continuously works to improve its procedures to ensure the protection of users’ privacy and the security of their information.

Marketing Messages and Notifications

The company may send users communications relating to services, offers, promotions, or new features in accordance with user preferences and applicable laws.

Users may opt out of receiving marketing communications at any time through the available unsubscribe mechanisms. However, the company may continue sending essential communications relating to the user’s account, rides, or service security.

Effective Date

This Privacy Policy shall become effective on:

August 5, 2026

and shall remain in effect until amended or replaced by a newer version published through Labby’s official communication channels.

Last Updated:

August 5, 2026