Privacy Policy
This Privacy Policy explains how HDR Agency ("we", "us", "our") collects, uses, shares, and protects your personal data when you use the Bosta (بوسطة) bus-ticketing and parcel-delivery service (mobile apps and website). It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR), Articles 13 and 14, as we operate in Syria and expand across the MENA region and the European Union.
1. Who We Are (Data Controller)
HDR Agency is the data controller responsible for your personal data under this policy. You can reach us, and our privacy/data-protection contact, here:
Privacy / Data Protection contact: privacy@hdragency.com
General support: support@hdragency.com
Website: https://bus.hdragency.com
For any privacy question or to exercise your rights (Section 6), email privacy@hdragency.com with the subject line "Privacy Request". Where required by law we will appoint an EU representative and/or a Data Protection Officer and publish their details here.
2. Personal Data We Collect & Its Sources
We collect the following categories of personal data, mostly directly from you, and some from your use of the service or from third parties as noted:
| Category | Details | Source |
|---|---|---|
| Account & identity | First and last name, father's name, gender, mobile number, email address, date of birth, and — where you provide it — your national ID number (الرقم الوطني) | You, at registration / profile setup |
| Identity-verification documents | Photographs of the front and back of your government-issued ID card, which you upload only if you choose to request the optional verified badge in the rider app. They are stored encrypted on a private server disk that is never served to the web, and are decrypted only when a reviewing administrator opens them to check them against your profile. | You, only if you submit a verification request (rider app) |
| Booking data | Trip date, route, seat number, boarding and drop-off points, ticket status, and the names and national IDs of the passengers you book for | You, at each booking |
| Parcel data | Sender and recipient names, phone numbers and addresses, parcel details, and optional attachment photos | You, for each shipment (recipient details are provided by you about a third party) |
| Payment & wallet | Wallet balance and ledger, top-up and spend history, refunds, transaction references, method type and amounts. Local top-ups use cash rails (MTN Cash, Syriatel Cash, Sham Cash). We do not store your card numbers — card payments, when available, are handled on the processor's hosted page. | You / your transactions |
| Device & push tokens | Push notification tokens (OneSignal for riders; Google/Firebase Cloud Messaging for the driver app) used to deliver alerts | Your device, on notification permission |
| Driver location (driver app) | Real-time location of drivers while on duty, to support live trip tracking | The driver's device (drivers only) |
| Rider location (rider app) | Your device's coordinates, collected only if you grant location permission and only while you are using the map, to centre the map on you and to draw the road route from where you are to a bus operator's office. To calculate that route those coordinates are sent to our servers, which pass them to the routing services that compute the road path (Section 4). The resulting route is cached for about a day under a hashed key so the same request is not recomputed; we do not build a location history of your movements. | Your device, with your permission (riders only) |
| Technical / diagnostic | OTP verification codes, authentication tokens, and error/crash diagnostics used to secure and maintain the service | Generated during your use of the service |
The national ID is a sensitive identifier: we collect it only where needed for operator boarding verification, minimise its exposure, and apply heightened safeguards to it. Uploading photographs of your ID card is optional and never required to book, travel or send a parcel — it is used only to award the verified badge, which may in turn be required for features we restrict to verified accounts (currently, submitting ratings and reviews).
3. Why We Use Your Data & Our Lawful Bases
Under GDPR Article 6 we must have a lawful basis for each purpose. The table below sets out what we do and why we are allowed to do it:
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Create and manage your account; log you in; send one-time passwords (OTP) by SMS/WhatsApp to verify your phone | Performance of a contract (Art. 6(1)(b)); account security also rests on our legitimate interest (Art. 6(1)(f)) |
| Process bookings and parcel shipments, issue QR tickets, manage your wallet, and provide customer support, cancellations and refunds | Performance of a contract (Art. 6(1)(b)) |
| Share passenger name and national ID (where provided) with the bus operator for boarding verification | Contract (Art. 6(1)(b)) and, for the operator, compliance with transport rules |
| Keep financial and transaction records (payments, wallet ledger) | Legal obligation (Art. 6(1)(c)) and legitimate interest in accurate accounting |
| Send transactional notifications (booking confirmations, trip and parcel updates, wallet changes) | Performance of a contract (Art. 6(1)(b)) |
| Send promotional / marketing messages | Your consent (Art. 6(1)(a)) — opt-in, and you can withdraw it at any time |
| Monitor errors and crashes, prevent fraud and abuse, and keep the platform secure and reliable | Legitimate interest (Art. 6(1)(f)) |
| Show live driver location during a trip (driver app) | Performance of a contract (Art. 6(1)(b)) / legitimate interest in safe, tracked trips |
| Centre the map on you and calculate the road route from your location to an operator's office (rider app) | Performance of a contract (Art. 6(1)(b)) — the feature runs only when you ask for it, and only after you grant your device's location permission, which you can withdraw at any time in your device settings |
| Review the ID-card photographs you upload against your profile in order to award (or refuse) the verified badge | Your consent (Art. 6(1)(a)) — verification is optional and starts only when you submit it; also our legitimate interest (Art. 6(1)(f)) in preventing impersonation on the platform |
We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.
4. Who We Share Data With (Service Providers) & International Transfers
We share personal data only with the service providers (processors) needed to run Bosta, and with bus operators as described above. Several of these providers are located outside Syria and outside the EU/EEA (mainly the United States), so using Bosta involves international transfers of your data.
| Recipient | Purpose | Data shared | Location |
|---|---|---|---|
| Twilio | Deliver OTP by SMS / WhatsApp | Your mobile number and the one-time code | USA / global |
| OneSignal | Rider push notifications | Push token and notification content | USA |
| Google / Firebase (FCM) | Driver-app push notifications | Device push token | USA / global |
| Google / Firebase Crashlytics | Crash and error reporting, in both the rider and driver apps, so we can find and fix faults | Crash and error reports: the technical stack trace, device model, operating-system and app version, and a per-installation identifier. In the driver app a driver's numeric account ID is attached to the session so a crash can be traced back to a trip; no name, phone number or token is sent. | USA / global |
| Google / Firebase Analytics | Aggregate product analytics, in both apps, to understand which features are used and where users get stuck. Not used for advertising and not used to build an advertising profile of you. | App and screen events (such as app opens), device and coarse country-level information, and a pseudonymous app-instance identifier assigned by the SDK | USA / global |
Map routing — the Google Directions API (maps.googleapis.com) first, and the public OSRM demo server (router.project-osrm.org) as the fallback |
Calculate the road route drawn on the map, including the route from your own location to an operator's office when you use the rider map | Only the coordinates to be routed — which include your own position in that case. No name, account, push token or other identifier is sent, and because our server makes the request on your behalf, your device's IP address is not shared with either routing service. | Google: USA / global. If Google does not return a route, the request falls back to router.project-osrm.org — the free public demo endpoint operated by the open-source OSRM project, which is not a provider we hold a contract or data-processing agreement with; the safeguards described below therefore cover the Google leg only. |
| Cloudflare R2 | Encrypted offsite database backups | Backup copies of the full account dataset | Global (Cloudflare) |
| Sentry | Error and crash monitoring | Technical diagnostics (configured to exclude personal data) | USA / EU |
| Bus operators | Boarding & seat verification | Passenger name, seat, boarding point, national ID (if provided) | Local |
| Stripe (only if card payments are enabled) | Hosted card checkout | Amount and item description only — no card number reaches us | USA |
Where we transfer personal data of individuals in the EU/EEA to a country without an EU adequacy decision, we rely on appropriate safeguards under GDPR Chapter V — primarily Standard Contractual Clauses (SCCs) and each provider's data-processing agreement. You may request a copy of the safeguards in place by emailing privacy@hdragency.com. We may also disclose data to legal authorities where required by a valid court order or applicable law.
5. How Long We Keep Your Data (Retention)
| Data | Retention period / criteria |
|---|---|
| Account & profile data | Kept while your account is active; anonymised when you delete your account (see Section 6) |
| Bookings, passengers & parcels | Kept for the life of the account; passenger names and national IDs are scrubbed when the account is erased |
| Identity-verification ID photos | Held encrypted while your request is under review and kept after the decision as the record supporting the verified badge (or the reason it was refused). They are not deleted on a schedule, and deleting your account does not currently remove them. To have them erased, email privacy@hdragency.com — note that this also removes the evidence for your verified badge. |
| Payment & wallet ledger | Retained for the period required by applicable tax and commercial law, then deleted or anonymised |
| OTP verification codes | Short-lived; expired codes are pruned automatically and not kept |
| Push tokens | Until you disable notifications or delete your account, whichever is first |
| Rider location used for map routing | Not stored in your account. The calculated route is cached for about a day under a hashed key and then discarded; no location history is kept. |
| Offsite backups | Held on a short rolling retention window (~14 days) and then overwritten |
| Error / crash diagnostics | Retained for a limited period per the monitoring provider's configuration |
6. Your Rights & How to Exercise Them
Subject to applicable law, you have the following rights over your personal data:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure ("right to be forgotten") — have your personal data deleted.
- Portability — receive your data in a structured, machine-readable format.
- Restriction — ask us to limit how we process your data in certain cases.
- Objection — object to processing based on our legitimate interests, and to any direct marketing.
- Withdraw consent — where processing is based on consent (e.g. marketing), withdraw it at any time without affecting prior processing.
Here is how to exercise the key rights:
Erasure — riders: use Delete Account in the rider app. Deletion anonymises your personal data — name, email, mobile, national ID, date of birth and device tokens are overwritten, and the names and national IDs of the passengers you booked are scrubbed — while any records we must retain for legal/financial reasons are stripped of identifiers.
Erasure — drivers: driver accounts are issued by the bus operator you drive for rather than created by you, and the driver app has no in-app deletion option. Ask your operator to remove your account, or request it from us directly using the process on our account-deletion page (email support@hdragency.com with the subject "Account Deletion Request" and the mobile number on the account).
For rectification, restriction, objection, or any right you cannot complete in the app, email privacy@hdragency.com (subject "Privacy Request"). We respond within one month, as required by GDPR.
7. Your Right to Complain to a Supervisory Authority
If you believe we have mishandled your personal data, you have the right to lodge a complaint with a data-protection supervisory authority — in the EU/EEA, the authority in your country of residence, work, or where the alleged infringement occurred. A directory is available from the European Data Protection Board. We would appreciate the chance to address your concern first, so please consider contacting us at privacy@hdragency.com.
8. Security
All data in transit is encrypted using HTTPS/TLS, offsite backups are encrypted, and authentication tokens are stored only on your device. We apply server-side access controls and minimise exposure of sensitive identifiers such as the national ID. No method of electronic storage or transmission is 100% secure; we cannot guarantee absolute security.
9. Children's Privacy
Bosta is intended for adults and users aged 16 and above (or the minimum digital-consent age in your country). We do not knowingly collect personal data from children below that age to create an account. Note that adult account holders may book travel for child passengers; that passenger data is provided by, and is the responsibility of, the booking adult. If you believe a child has created an account or provided us data directly, contact privacy@hdragency.com and we will delete it promptly.
10. Cookies & Tracking
Our website uses a single first-party session cookie that is strictly necessary to keep you signed in; we do not use advertising or third-party tracking cookies. The mobile apps do not use browser cookies but rely on the device push tokens and diagnostics described above. Because we use only essential cookies, no consent banner is required, but you can clear cookies at any time in your browser.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top and, for material changes, notify you via in-app notification and/or email before the change takes effect. Continued use of Bosta after the revised date constitutes acceptance of the updated policy.
12. Contact Us
Privacy / Data Protection: privacy@hdragency.com
Support: support@hdragency.com
App: Bosta — Intercity Bus & Parcel Marketplace
Website: https://bus.hdragency.com