Privacy Notice
1. Introduction
This Privacy Notice governs the collection, use, disclosure, retention, transfer, protection and other processing of personal data through the iDrive2 mobile application, public landing page, Advertiser Portal, Admin Portal, other authorised browser-based Platform environments, and related Platform services (collectively, the “Platform”).
This Privacy Notice is issued in accordance with the Personal Data Protection Law of the Kingdom of Bahrain (Law No. 30 of 2018) (“PDPL”).
This Privacy Notice is intended to explain:
- What personal data iDrive2 processes;
- The purposes for which personal data is processed;
- The lawful bases on which such processing is carried out;
- How personal data may be shared, retained, protected, or transferred;
- The rights available to data subjects under applicable law; and
-
How users may contact iDrive2 in relation to personal data matters. This Privacy Notice applies to personal data processed in relation to:
-
Learners;
- Instructors;
- Advertisers and Sponsors;
- Admin Users;
- Super Admin Users;
- Other portal users, where applicable
- Visitors to the public landing page and guest users, where applicable; and
- Any other person whose personal data is processed within the Platform environment. iDrive2 also maintains internal data-retention, information-security, access-control and incident-response procedures supporting the lawful processing and protection of personal data.
By creating an account, accessing, or using the Platform, users acknowledge that their personal data may be processed in accordance with this Privacy Notice and the lawful bases described herein.
This Privacy Notice does not, by itself, constitute consent to processing where consent is required as the applicable lawful basis. Where consent is required, iDrive2 will obtain it separately through the appropriate Platform, device or privacy control.
Nothing in this Privacy Notice expands the role of iDrive2 beyond that of a digital marketplace platform.
2. Data Controller
The data controller for personal data processed within the Platform environment is:
Condor Gulf Technologies, P. O. Box 32122, Manama, Kingdom of Bahrain
Condor Gulf Technologies, as the operator of iDrive2, acts as data controller in relation to personal data processed through the Platform's technical infrastructure, including account registration, identity and eligibility verification, booking coordination, subscription administration, advertising and promotional service administration, Platform communications, moderation, fraud prevention, dispute handling, security monitoring, support handling and related Platform operations.
References to “iDrive2” in this Privacy Notice refer to Condor Gulf Technologies in its capacity as operator of the iDrive2 Platform, unless the context requires otherwise.
Driving Instructors remain independently responsible for personal data they process outside the Platform environment, including through their own records, communications, service-delivery arrangements and compliance activities.
iDrive2:
- Determines the purposes and means of processing for personal data handled within the Platform environment;
- Does not determine the purposes or means of processing conducted independently by Instructors outside the Platform; and
- Does not control Instructor-side records, communications, or data handling outside the Platform environment. Where third-party service providers process personal data on behalf of iDrive2, including cloud hosting, infrastructure, analytics, communications, fraud-prevention, customer-support or other service providers, they are subject to appropriate contractual and data-protection safeguards where applicable. Certain third parties, including payment providers or app-store operators, may also process personal data independently for their own lawful purposes under their own privacy terms.
For privacy inquiries or rights requests, users may contact:
3. Platform Role And Data Governance Context
iDrive2 operates solely as a digital marketplace platform facilitating discovery, visibility, booking coordination, subscription access, promotional visibility tools, and related marketplace functionality.
Accordingly, personal data processed by iDrive2 is limited to data reasonably required for the operation, administration, security, integrity, compliance, and improvement of the Platform.
For the avoidance of doubt, iDrive2:
- Is not a driving school;
- Is not the provider of driving instruction services;
- Does not supervise or control lesson delivery;
- Does not process, hold, receive, or control lesson fees between Learners and Instructors; and
- Does not become a party to private lesson arrangements between Learners and Instructors merely because certain booking or communication functions are facilitated through the Platform. Where Instructors process personal data outside the Platform environment, including through their own independent records, off-platform communications or service-delivery arrangements, they may act as separate and independent controllers in respect of that processing.
4. Categories Of Personal Data Processed
Depending on the user type, feature usage, subscription status, verification status, permissions enabled, and interaction with the Platform, iDrive2 may process the following categories of personal data.
5. Identity And Registration Data
This may include:
- Full name;
- Date of birth, where required;
- ID or other lawful identifier where accepted;
- Account login details;
- Mobile number;
- Email address; and
- Account registration metadata.
6. Profile And Account Data
This may include:
- Profile information;
- Language preferences;
- City, district, living area, or service area;
- Profile photographs or uploaded images;
- Instructor biography, qualifications, and vehicle details where applicable;
- Learner account settings;
- Subscription status; and
- Account status. Certain profile fields may be optional and may be provided voluntarily to improve Platform functionality or user experience.
7. Eligibility And Verification Data
This may include:
- Learner driving licence information;
- Instructor licence information;
- ID number where collected lawfully and reasonably required;
- Vehicle registration details;
- Insurance-related records where collected;
- Identity verification materials;
- Uploaded onboarding documents;
- Certification documents; and
- Document validity or verification status. Certain higher-risk identity and verification data may be collected where reasonably necessary for identity verification, fraud prevention, regulatory compliance or Platform security. Such data is subject to enhanced access restrictions and additional security safeguards where applicable.
8. Professional And Marketplace Data
For Instructors, this may include:
- Years of experience;
- Service area;
- Vehicle make, model, and year;
- Availability calendar;
- Ratings and feedback;
- Selected public-facing professional profile data. Only selected professional fields are publicly displayed through the Platform.
9. Booking And Operational Data
This may include:
- Booking requests;
- Booking confirmations;
- Cancellations;
- No-show classifications;
- Scheduling data;
- Lesson request records;
- Workflow status changes;
- Platform timestamps;
- Operational support records.
10. Payments, Billing, And Transaction Data
This may include:
- Subscription purchases;
- Advertising or promotional purchases;
- Gateway transaction references;
- Invoices and receipts;
- Refund records;
- Chargeback-related records; and
- Billing history relating only to payments made directly to iDrive2. For clarity, iDrive2 does not process lesson fees paid directly between Learners and Instructors.
11. Communications Data
This may include:
- Support inquiries;
- Platform messaging data where available through the Platform;
- Complaint records;
- Dispute submissions;
- Moderation-related communications; and
- Other communications processed within the Platform environment.
12. Ratings, Reviews, And Marketplace Interaction Data
This may include:
- Ratings;
- Written reviews;
- Reported feedback;
- Moderation notes;
- Ranking-related input signals;
- Search filters used;
- Instructor comparison activity, where such usage analytics are enabled; and
- Records of review abuse or review enforcement.
13. Advertising And Campaign Data
This may include:
- Advertiser account data;
- Company name and contact person details;
- Campaign submissions;
- Creative assets;
- Approval or moderation records;
- Campaign settings;
- Placement records;
- Campaign metrics;
- Advertiser communications; and
- Advertising billing records.
14. Administrative And Restricted-Portal Data
For Admin Users, Super Admin Users and other authorised restricted-access portal users, where applicable, this may include:
- Account and authorised-user details;
- Organisation or role information, where applicable;
- Assigned roles and permissions;
- Account status;
- Authentication and MFA records;
- Administrative actions and workflow activity;
- Access to restricted records or functions;
- Reason or justification records associated with sensitive-data access, where required; and
- Audit and access-control records. Such data is processed for authentication, role-based access control, accountability, security, auditability, compliance and administration of restricted Platform environments. Access to records and functions is determined by the permissions assigned to the relevant user account and may be configured or amended by authorised administrators in accordance with applicable access-control requirements.
15. Technical, Device, Analytics, And Log Data
This may include:
- IP address;
- Device identifiers;
- Browser type;
- Operating system;
- Device type;
- App version;
- Device and app permission status, where relevant to an implemented Platform feature;
- Authentication records;
- Login timestamps;
- Push notification tokens;
- Security logs;
- Privileged-access logs;
- Audit trails;
- Error logs;
- Performance logs;
- App usage metrics;
- Feature interaction data; and
- Platform usage metadata. Where information has been aggregated so that individual users are no longer reasonably identifiable, it may be used for service improvement, area statistics, Instructor-density analysis and operational reporting.
16. Location Data
Where enabled or permitted, this may include:
- Approximate geolocation;
- Map display data; and
- Location permission status. Location data is used only for reasonably necessary Platform functionality such as map display, service localization, and Instructor search relevance, where applicable.
The Platform does not conduct continuous background location tracking unless such functionality is expressly introduced, clearly disclosed, and lawfully enabled.
17. Enforcement, Safety, And Compliance Data
This may include:
- Reports of misconduct;
- Fraud flags;
- Abuse reports;
- Safety investigation records;
- Account restrictions;
- Suspension history;
- Enforcement notes; and
- Records required for legal, regulatory, or evidentiary compliance.
18. Sources Of Personal Data
iDrive2 may obtain personal data from one or more of the following sources:
- Directly from the user during registration, verification, profile completion, booking activity, payments made directly to iDrive2, device-permission enablement, support contact or other Platform use;
- From user-submitted documents, content, messages, or campaign materials;
- From platform-generated records, logs, timestamps, and system activity;
- From payment gateways or app-store billing environments in relation to payments made directly to iDrive2;
- From complaints, dispute submissions, moderation reports, or safety reports submitted by users;
- From service providers, vendors, or processors supporting Platform operations;
- From regulators, courts, law-enforcement bodies or other competent authorities where information is lawfully provided to iDrive2; AND
- From cookies, analytics tools, software development kits (SDKs), device or operating-system generated technical signals, app-permission status, and similar technologies where implemented lawfully.
19. Purposes Of Processing
iDrive2 may process personal data for one or more of the following purposes:
- Account creation and account administration;
- User authentication and access control;
- Managing device permissions and enabling user-requested Platform functionality, where applicable;
- Learner and Instructor eligibility verification;
- Document validation and compliance review;
- Booking coordination and operational workflow management;
- Subscription administration;
- Advertising, sponsored listing, and campaign administration;
- Processing payments made directly to iDrive2;
- Issuing invoices, receipts, refund determinations, and related billing records;
- Customer support and user communications;
- Ratings, reviews, and marketplace transparency features;
- Search, ranking, comparison, recommendation, and marketplace relevance tools;
- Fraud prevention, abuse prevention and enforcement of Platform access, subscription, booking, contact and security controls;
- Platform moderation, safety review, and conduct enforcement;
- Dispute handling and internal administrative review;
- Chargeback review relating to payments made directly to iDrive2, no-show review and evidentiary preservation;
- Security monitoring, audit logging, incident detection, and forensic preservation;
- Service analytics, troubleshooting, and platform improvement;
- Legal, regulatory, tax, accounting, audit, and recordkeeping compliance;
- Lawful cooperation with courts, regulators, law enforcement, insurers, payment providers, app stores, or other competent authorities where required or reasonably necessary. Personal data is processed only for purposes that are defined, legitimate, proportionate, and reasonably connected to the operation and governance of the Platform.
iDrive2 does not:
- Process or hold lesson fees between Learners and Instructors;
- Sell personal data;
- Engage in data brokerage activities; or
- Use personal data for unrelated third-party commercial exploitation.
20. System Ranking, Recommendations, And Assistive Platform Logic
Instructor visibility, search ordering, comparisons, matching outputs and recommendation results may be generated using rule-based and configuration-driven criteria designed to support relevance and marketplace functionality. Such criteria may include:
- User-selected filters;
- Instructor availability;
- Service area relevance;
- Profile completeness;
- Ratings and feedback;
- Responsiveness metrics;
- Activity levels within the Platform;
- Booking-related data;
- Visibility entitlements associated with sponsored listings or other paid promotional features; and
- Other operational ranking signals lawfully used within Platform rules. Ranking is dynamic and may vary over time based on marketplace activity, available data, and system inputs.
The Platform does not use automated processing to make decisions that independently produce legal effects concerning users. Platform ranking, recommendation, visibility, and matching tools are assistive mechanisms only and do not determine legal rights, licensing status, regulatory eligibility, or external service entitlements.
21. Lawful Bases For Processing
To the extent required by the PDPL and applicable law, iDrive2 processes personal data on one or more applicable lawful bases, including:
- Consent, where consent is required or relied upon;
- Performance of a contract to which the data subject is a party;
- Taking steps at the request of the data subject for the purpose of entering into a contract;
- Compliance with a legal obligation, or compliance with an applicable order of a competent court or the Public Prosecution;
- Protection of the vital interests of the data subject, where applicable; and
- Pursuit of the legitimate interests of iDrive2 or a relevant third party to whom personal data is disclosed, provided that such interests do not conflict with the fundamental rights and freedoms of the data subject, where permitted under applicable law. Where consent is relied upon as the lawful basis for processing, the data subject may withdraw that consent through the available Platform, device or privacy controls, or by contacting iDrive2 where appropriate. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not prevent continued processing where another lawful basis applies.
Where processing relies on legitimate interests, iDrive2 assesses whether the processing is reasonably necessary and proportionate and whether the relevant interests conflict with the fundamental rights and freedoms of the data subject.
22. Data Minimisation
iDrive2 collects and processes only the personal data that is reasonably necessary to operate, secure, administer, and improve the Platform.
Personal data collection is limited to what is reasonably required to:
- Verify identity, eligibility, and professional credentials where applicable;
- Enable booking coordination and platform communications;
- Administer subscriptions, promotions, and related billing;
- Comply with applicable legal or regulatory requirements;
- Maintain Platform security and prevent fraud, misuse, or abuse; and
- Support dispute handling, moderation, enforcement, and recordkeeping obligations. Optional fields may be identified where applicable. Where a feature is optional, users may choose not to provide certain information, subject to the functionality of the relevant service.
23. Data Sharing And Disclosure
iDrive2 may disclose or make personal data available only where lawful, proportionate and reasonably necessary for Platform operation, authorised user interaction, payment processing, compliance, security or other purposes described in this Privacy Notice.
Personal data may be made available to:
- Instructors, solely to the extent reasonably necessary for an authorised Learner–Instructor interaction, booking coordination, Platform communication or other booking-related functionality. Instructors do not receive general access to Learner personal data;
- Learners, only to the extent that Instructor information is lawfully displayed or made available through public profiles, booking workflows or authorised Platform functionality;
- Payment processors and billing providers, in relation to payments made directly to iDrive2;
- Cloud hosting, infrastructure, storage, communications, customer-support, analytics, security and other service providers supporting Platform operations;
- App-store operators, where distribution, subscription billing or related functionality occurs through their systems;
- Auditors, legal advisers, insurers and other professional advisers, where reasonably necessary and subject to appropriate confidentiality obligations;
- Courts, regulators, law-enforcement agencies and other competent authorities, where disclosure is required or permitted by applicable law; and
- Authorised iDrive2 personnel, subject to role-based access controls, least-privilege principles and need-to-know restrictions. Contact details and other restricted or higher-risk personal data may be masked or restricted by default and made available only where the applicable Platform workflow, permission or lawful operational purpose permits access.
Access by Admin or Super Admin personnel to restricted or higher-risk personal data is subject to role-based access controls and access logging and, where appropriate, requires a documented operational reason.
Authorised portal users may access only the records, data and functions permitted by the role-based permissions assigned to their account. Access to restricted or higher-risk personal data is subject to applicable least-privilege, purpose-limitation, masking, access-control and logging requirements. Permissions may be configured or amended by authorised administrators in accordance with the approved Platform permission model. Organisational affiliation alone does not provide access to any category of personal data.
Advertisers and Sponsors may receive campaign-related reporting and performance information but do not receive unrelated personal information relating to Learners or Instructors merely because they advertise through iDrive2.
iDrive2 does not sell personal data as a data broker and does not disclose personal data for unrelated third-party marketing or unrelated commercial exploitation.
24. Advertising, Relevance, And Promotional Processing
Where users purchase or interact with advertising, sponsored listings, or promotional visibility services, iDrive2 may process relevant account, placement, campaign, billing, performance, moderation, and limited location or platform-section data for campaign administration, fraud prevention, approval workflow, moderation, reporting, and related operational purposes.
Campaign reporting provided to Advertisers is intended to use campaign-related Platform information and does not provide Advertisers with unrelated Learner or Instructor personal data.
Unless expressly introduced under published platform functionality and lawful terms, iDrive2 does not operate third-party ad exchanges, real-time bidding systems, or advanced behavioural advertising networks.
25. Fraud Prevention, Safety, Dispute Handling, And Enforcement
Personal data may be processed for fraud prevention, abuse detection, safety review, policy enforcement, dispute handling, chargeback review relating to payments made directly to iDrive2, no-show review, moderation, investigative review and evidentiary preservation. This may include review of:
- Authenticated system logs;
- Booking records and transaction records relating to payments made directly to iDrive2;
- Communication records processed within the Platform;
- Dispute submissions;
- Uploaded documents;
- Safety reports;
- Account history; and
- Prior enforcement history. Such processing is carried out for platform integrity, lawful compliance, protection of users, and defense of legal rights and does not make iDrive2 the supervisor of real-world lesson activity.
Access to Platform communications or other restricted personal data for dispute, safety, fraud, support or enforcement purposes is limited to authorised personnel where reasonably necessary for the relevant review and is subject to role-based permissions and access logging. Access to sensitive or restricted information may additionally require documented justification.
26. Data Retention
Personal data is retained only for as long as reasonably necessary and lawful for the purposes described in this Privacy Notice, including compliance, audit, fraud prevention, dispute handling, security monitoring, legal hold, and evidentiary preservation.
iDrive2 maintains internal retention schedules, deletion rules, anonymisation standards, legal-hold procedures, backup controls and secure-disposal requirements governing different categories of Platform records. Retention periods vary depending on the nature of the data, the purpose for which it is processed and any applicable legal, accounting, audit, fraud-prevention, dispute, security or evidentiary requirements.
Where there is any active dispute, chargeback, fraud review, safety investigation, legal hold, regulatory inquiry, or legal requirement, relevant records may be retained for longer to the extent lawfully necessary.
27. Security Safeguards
iDrive2 applies technical and organizational safeguards designed to protect personal data, which may include where applicable:
- Encryption in transit and at rest;
- Role-based access control;
- Least-privilege restrictions;
- Masking or limited display of sensitive data;
- Privileged-access logging;
- Audit trails;
- Malware scanning for applicable uploads;
- Monitoring and alerting controls;
- Environment segregation;
- Incident response procedures; and
- Backup and recovery protections. Access to restricted or higher-risk personal data may be restricted, logged, monitored, and justified according to internal access-control and governance rules where applicable.
No method of transmission or storage can guarantee absolute security. Users are also responsible for safeguarding their credentials and using the Platform responsibly.
28. Cross-Border Transfers
Where personal data is transferred, stored, accessed, backed up or otherwise processed outside the Kingdom of Bahrain, iDrive2 will ensure that such transfer or processing is undertaken in accordance with applicable requirements governing international transfers of personal data under the PDPL.
Where required, iDrive2 will rely on an applicable lawful transfer mechanism, authorisation, exception or other basis permitted under Bahrain law before transferring personal data outside the Kingdom of Bahrain.
Appropriate technical and organisational safeguards may also be applied having regard to the nature of the personal data, the processing involved and the associated risks. Such safeguards may include:
- Contractual protections;
- Encryption in transit and at rest;
- Access restrictions;
- Least-privilege controls;
- Auditability of privileged access; and
- Documented necessity and proportionality. Cross-border processing will be limited to what is reasonably necessary for Platform functionality, infrastructure support, security, resilience, communications, analytics, payment-related operations or other lawful Platform purposes.
29. Data Subject Rights
Subject to the PDPL, applicable law, and lawful limitations, data subjects may have rights including the right to:
- Request access to personal data;
- Request rectification, blocking or erasure of personal data where the applicable conditions under the PDPL are satisfied;
- Object to or request restriction of certain processing where applicable;
- Withdraw consent where consent is the lawful basis;
- Request information about the processing of their personal data;
- Request appropriate review in relation to decisions based solely on automated processing where such a right applies under the PDPL; and
- Submit a complaint to the competent authority where permitted by law. To protect privacy and security, identity verification may be required before fulfilling a request. Rights are not absolute and may be limited where retention or processing remains necessary for legal compliance, dispute handling, fraud prevention, security, enforcement, evidentiary preservation, or other lawful purposes.
Requests may be submitted to: info@iDrive2app.com
Requests will be handled within the timeframes required by applicable law. Where a valid request is made to rectify, block or erase personal data under the PDPL, iDrive2 will respond within a period not exceeding ten (10) working days from receipt of the request, subject to applicable legal requirements and verification of identity. Other data-subject requests will be handled within the applicable statutory timeframe, where one is prescribed, or otherwise within a reasonable timeframe.
Where a request is submitted by an authorized representative, additional verification or proof of authority may be required.
Where a request cannot be fulfilled in whole or in part due to legal, regulatory, security, evidentiary, or contractual obligations, the user may be informed accordingly, subject to applicable law.
30. Children’S Data And Eligibility
The Platform is intended only for individuals who are eligible to use the relevant iDrive2 services under the laws of the Kingdom of Bahrain and the applicable iDrive2 Terms.
Where use of a particular service requires a Learner driving licence, Instructor licence, or other applicable regulatory qualification, the user must satisfy that requirement before using the relevant feature or service.
Account-based iDrive2 services intended for Learners, Instructors, Advertisers or other registered users are not directed to children or to persons who do not satisfy the applicable legal or Platform eligibility requirements.
The public landing page may be viewed without creating an account, but it is not designed to solicit personal data from children.
iDrive2 does not knowingly permit persons who do not satisfy the applicable eligibility requirements to create or maintain an account for services for which they are not eligible.
Where it becomes apparent that an account has been created by a person who does not meet the applicable eligibility requirements:
- The account may be suspended or restricted; and
- Personal data may be deleted, subject to applicable legal, regulatory, fraud-prevention, or evidentiary obligations. Parents or legal guardians who believe that personal data has been provided by a minor may contact:
31. Data Breach Response
iDrive2 maintains internal procedures for identifying, assessing, escalating, containing, and responding to personal data security incidents.
In the event of a personal data breach, iDrive2 may take such steps as are appropriate in the circumstances, including:
- Internal escalation and containment;
- Assessment of the nature, scope, and likely impact of the incident;
- Implementation of corrective and mitigation measures;
- Regulatory notification where required by applicable law; and
- User notification where legally required or where risk to affected individuals justifies notification. Not all security incidents constitute reportable personal data breaches. Incidents are assessed based on risk, facts, materiality, and legal requirements under the PDPL.
Such internal procedures address investigation, containment, escalation, documentation, corrective action and applicable notification requirements.
32. Cookies, Analytics, And Similar Technologies
The Platform may use cookies, SDKs, pixels, local storage, log technologies, or similar tools for authentication, session management, security, fraud prevention, user preferences, performance monitoring, analytics, attribution, diagnostics, and service administration.
Where implemented, such technologies may collect technical and usage information such as device identifiers, browser type, operating system, IP address, app events, page interactions, referral source, and session activity.
Non-essential cookies or tracking technologies shall be used only where permitted under applicable law and, where required, only after obtaining valid user consent through the relevant consent or privacy controls.
Users may manage certain tracking preferences through browser settings, device settings, app permissions, or platform consent tools where available.
Further information about cookies and similar technologies used within browser-based Platform environments is provided in the iDrive2 Cookie Notice. Native-app technologies, including SDKs, device identifiers, app permissions and related technical signals, are addressed through this Privacy Notice and relevant in-app permission or privacy controls.
33. Third-Party Services
The Platform may interact with third-party services including payment gateways, app-store operators, analytics providers, infrastructure vendors, customer support tools, communications services, mapping tools, and security vendors.
Where a user independently accesses a third-party service outside the Platform, that third party's own privacy practices may apply and may be outside iDrive2's control. Where iDrive2 appoints or integrates a third-party service provider to process personal data on its behalf, iDrive2 addresses that relationship in accordance with applicable data-processing, contractual, security and data-protection requirements. Certain third parties may process personal data independently for their own lawful purposes under their own privacy terms.
34. Contact
Questions, privacy inquiries or data-subject requests relating to this Privacy Notice or the processing of personal data may be directed to:
Email:
Data-subject rights requests will be handledin accordance with Section 16 of this Privacy Notice and applicable law.
Nothing in this section limits any rights or remedies available under applicable law.
35. Privacy Notice Updates
iDrive2 may update this Privacy Notice from time to time to reflect changes in Platform functionality, personal-data processing activities, third-party service providers, business operations, or legal and regulatory requirements.
Updated versions will identify the applicable effective date and will be made available through the Platform or another appropriate communication channel.
Where an update materially changes how personal data is processed, iDrive2 will provide any additional notice required by applicable law.
Where the updated processing requires consent and the existing consent does not lawfully cover the new processing, iDrive2 will obtain any new or renewed consent required before undertaking that processing.
Continued use of the Platform does not by itself constitute consent to new processing activities where consent is legally required.