Privacy Policy

#Read this first — the short version

We are a company that puts advertising panels on the side doors of private cars. Drivers earn money for every kilometre they drive while a campaign is running, so we have to measure distance, and to measure distance we have to record where the car goes. That is the heart of this policy, and section 5 explains it in detail.

Three promises we can actually keep, because our database enforces them and not just this page:

1. Brands never see where you personally drove. They receive area totals and verified kilometre counts. Our access rules block them from your individual location records entirely.
2. We do not sell your personal data. Not to brands, not to data brokers, not to anyone.
3. Turning off location tracking stops kilometres accruing. It does not close your account and it does not cancel money you have already earned.

#1.Who we are

In this Policy, "we", "us" and "Poster Mobility" mean the company above. We are the data controller for the personal data described here.

We deliberately do not publish a telephone number, because we do not yet operate a monitored phone line and a dead number is worse than none. Email reaches us.

#2.Scope — what this Policy covers

This Policy covers personal data we process through:

• the website at postermobility.com, including the driver application form and the brand enquiry form;
• the Poster Mobility mobile application for drivers, including its background location tracking and document upload;
• the driver dashboard and brand portal, including the web-based trip tracker;
• offline processing — vehicle inspection, panel installation and removal, odometer readings, and spot checks.

It does not cover third-party websites we link to, or a brand's own processing of its customer data.

A note for drivers using the app: earlier versions of this Policy described the website only. This version is the first to describe the mobile application, its background location collection, the device information it reads, and the identity documents it asks you to upload. If you accepted a previous version, we will ask you to review and accept this one.

#3.The personal data we collect

#3.1 Driver identity and contact

Collected when you apply through the website form or create an account.

#3.2 Identity documents — collected by the mobile app only

These are stored as files with a status (pending / approved / rejected) and, where relevant, an expiry date so we can prompt you to renew.

#3.3 Vehicle data

Make, model, year, colour, licence plate number (in both its original and a normalised form, because Egyptian plates mix Arabic and Latin numerals), vehicle condition, eligibility status, and any rejection reason.

The plate is the identifier that ties a car to a campaign. It is also, unavoidably, information about you.

#3.4 Location data — the most sensitive category we hold

Treated separately and in full at section 5. In summary we record, for each trip: a timestamp, latitude, longitude, and the accuracy of the fix. The mobile app additionally records speed, altitude, your device's battery percentage, and a flag indicating whether the operating system reported the location as mocked or simulated.

We record battery percentage for one reason: to distinguish a driver whose phone died mid-trip from a driver who switched tracking off, so we do not wrongly dispute your kilometres. We do not use it for anything else.

#3.5 Financial data

We never see or store card numbers. When a brand pays, card details are entered directly with Paymob, our payment processor. What reaches our systems is a transaction reference and a result.

#3.6 Verification media

Odometer photographs at the start and end of a campaign period, with the readings and any notes. Installation photographs recording that the panel was fitted correctly.

Photographs can carry embedded metadata, including the location and time they were taken. Where we retain a photograph beyond the check it was taken for, we remove the embedded location metadata from it.

#3.7 Brand and advertiser data

Company name, industry, contact name, email and phone, campaign details (cities, districts, dates, number of cars), creative files, billing records and invoices.

#3.8 Technical and device data

#3.9 Records of your dealings with us

Support tickets and messages, notifications we have sent you, your acceptance of this Policy and our Terms (which document, which version, when, and whether from the website or the app), and an internal audit log of administrative changes made to your records — for example a change to a verified kilometre figure, and who made it.

The audit log exists to protect you. If someone at Poster Mobility alters your earnings, there is a record of it.

#3.10 What we do not collect

We do not ask you for, and do not use, information about your religion, health, political opinions or biometrics, or any information about your family. An Egyptian ID card shows religion on its face; we do not extract that field, record it separately, or act on it. We do not read your contacts, photos beyond the documents you choose to upload, messages, or call history. We do not track your web browsing across other sites.

#4.Why we process your data, our lawful basis, and how long we keep it

Under the Personal Data Protection Law No. 151 of 2020 (PDPL) and its Executive Regulations (Decree No. 816 of 2025), we must have a lawful basis for every use. Ours are: your consent; performance of our contract with you; compliance with a legal obligation; and establishing or defending legal claims.

Account closure. When you close your account we delete or anonymise your personal data on the schedule above, but we keep what tax law requires us to keep, and we keep a minimal anonymised reference linking historical campaign and earnings records to a person we can no longer identify. We already do this: closed accounts are replaced with an anonymised reference and the count of records retained.

#5.Location tracking — in full

This is the section that matters most, so it is the longest.

#5.1 Why we do it at all

You are paid per kilometre. A kilometre has to be measured. Self-reported distance would be unfair to honest drivers and impossible to invoice to a brand. So the only reason we collect your location is to count kilometres you are owed money for, and to report to a brand how much coverage its campaign achieved in each area.

#5.2 When tracking is on, and when it is off

Tracking is active only while a trip is running, and a trip runs only when:

• you have an active campaign assignment, and
• you have started a trip yourself, and
• you have granted location permission to the app or browser.

Tracking stops when you end the trip, when the campaign ends, when you revoke location permission, or when you sign out.

It is not always on. We do not track you between trips. We do not track you when no campaign is running. We do not track you if you never start a trip.

#5.3 Background collection — please read this

In the mobile app, location is collected in the background — that is, while the app is not on screen and while your phone is locked. This is necessary because you are driving, and your phone should be in a cradle or your pocket, not held in your hand.

We have deliberately not hidden this:

• On Android, a permanent notification reads "Recording your campaign kilometres" for the entire time a trip is running. It cannot be dismissed while tracking is active.
• On iOS, the blue status bar indicator stays visible. We have not suppressed it.

If you are not seeing one of those indicators, we are not recording your location.

On the website tracker, there is no background collection at all — recording only happens while the tracker page is open.

#5.4 How often, and how precisely

We request high accuracy rather than a battery-saving approximation for a reason that works in your favour: a coarse fix produces a straight line across a curved road, and you would be paid for the shortcut instead of the route. Accuracy costs battery, and we think being paid correctly is worth it. You are told this before you start.

#5.5 What a brand receives

A brand never receives your identity, your home, or your route. A brand sees:

• total verified kilometres across its campaign,
• coverage by governorate, and a coarse heat map of roughly two-kilometre squares, both aggregated across all cars,
• the number of cars active.

This is not merely a policy statement. Brand accounts are blocked from reading individual location records at all. A brand could not retrieve your trace if it tried.

#5.6 What we do *not* do with it

We do not use your location to work out where you live, where you sleep, who you visit, what your religion is, or what you do when no campaign is running. We do not build a profile of your private life. We do not sell location data. We do not share it with advertisers, insurers or employers.

#5.7 Turning it off

You can:

• stop a trip at any time, from the app or the dashboard;
• revoke location permission in your phone's settings;
• withdraw your location consent entirely by contacting us.

What happens then: kilometres stop being counted from that moment, so you stop earning for distance driven while it is off. That is the only consequence.

What does not happen: your account is not closed, you are not penalised, and kilometres you have already earned are still owed to you and will still be paid. If a campaign requires tracking to continue and you do not wish to be tracked, we will end that campaign assignment — we will not confiscate what you have already earned.

#6.Consent — how we ask, and how you take it back

#6.1 How we ask

Under the PDPL, consent must be specific, unambiguous, freely given, and capable of being withdrawn. Beyond what the law requires, we do not use pre-ticked boxes, and we do not treat silence, inactivity, or continued use as consent. Consent is requested in Arabic, and separately from this Policy — reading this page is not consenting to anything.

#6.2 Consent is granular — four separate choices

Identity documents carry a heightened requirement. An Egyptian national ID card shows the holder’s religion on its face, and religious belief is sensitive personal data under the PDPL. So we ask for explicit consent to identity documents separately, and we apply stricter access controls to them.

#6.3 Taking consent back

Withdrawing consent is as easy as giving it. Each of the four consents above can be withdrawn on its own, at any time, from your account settings or by emailing us. We will confirm when it is done.

Withdrawal applies going forward. It does not make our earlier processing unlawful, and it does not affect money you have already earned.

#7.Your rights

Under the PDPL you have the right to:

#7.1 How to exercise them

Email info@postermobility.com with what you want and enough detail to find your records.

We will verify who you are first. This protects you: we will not hand your location history to somebody claiming to be you. Verification is proportionate — usually confirming control of the registered email or phone number. We will not demand a copy of your ID to answer a request unless there is a genuine reason to doubt.

How quickly: we aim to respond within six (6) working days of verifying your identity. If a request is complex and we need longer, we will tell you before that deadline, explain why, and give you a date. If we refuse a request, we will tell you why and how to challenge it.

It is free. We do not charge to answer a rights request.

#8.Children

Poster Mobility is not offered to anyone under 18. Every driver must hold a valid Egyptian driving licence, which is not issued to minors, and brand accounts are for businesses.

We do not knowingly collect personal data from children. Where the PDPL requires the written consent of a legal guardian for the processing of a child's data, we would obtain it — but the correct answer for this service is that we should not be holding a child's data at all. If you believe a child has given us personal data, contact us and we will delete it.

#9.Marketing

We send marketing only if you have opted in. Every message carries a working unsubscribe link, and unsubscribing takes effect immediately.

Service messages are different and you cannot opt out of them while you hold an account — for example a payout confirmation, a campaign assignment, a document expiry warning, or a change to this Policy. They are not marketing.

Direct electronic marketing in Egypt requires its own licence from the PDPC under the Executive Regulations, and is also subject to the Telecommunication Regulation Law No. 10 of 2003. We will not send marketing communications until that licence is in place.

#10.Automated processing and decisions

We use automated checks on location data to detect faked kilometres. These automatically discard implausible fixes, and flag trips with a risk score based on signals such as mocked-location reports, rooted devices, and impossible speeds.

What is automated: the flag and the score. What is not automated: the decision. A person reviews any flagged trip before it affects your earnings. No trip is rejected, and no payment is withheld or reduced, purely by an automatic process.

You have the right to ask for human review of any decision affecting your kilometres or earnings, to be told the reason, and to contest it. Section 22 of our Terms sets out the dispute process and the time within which we will respond, and no deduction is made from your earnings until that process has run.

We do not use automated profiling for advertising, credit scoring, or any purpose unrelated to verifying kilometres.

#11.Changes to this Policy

We will update this Policy as the service changes and as PDPC guidance develops.

• Minor changes (clarifications, typographical fixes) — published here with a new version number and date.
• Material changes — we will notify you individually, by email or in-app notification, at least 14 days before they take effect. If a material change concerns something you consented to, we will ask for your consent again rather than assume it.

Each version carries a version number, and we record which version you accepted and when. A version history is published at the foot of this page.

Version history

#12.Contact and complaints

Come to us first — we would rather fix it than have you escalate:

• Privacy, data protection and rights requests: info@postermobility.com
• Data Protection Officer: write to info@postermobility.com, marked for the attention of the Data Protection Officer
• Post: at the registered address in section 1

If we do not resolve it, you have the right to complain to the supervisory authority:

The Personal Data Protection Centre (مركز حماية البيانات الشخصية) under the Ministry of Communications and Information Technology, Arab Republic of Egypt.

Complaining to the PDPC does not cost you anything and does not affect your account with us.

#13.Governing law

This Policy is governed by the laws of the Arab Republic of Egypt, and in particular the Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.

#See also

• Terms of Service — the contract between us, including how kilometres are verified and paid.

*This Privacy Policy was prepared for Poster Mobility and reviewed against the applicable Egyptian legal framework as at its effective date.*

Arabic governs. In the event of any discrepancy between the Arabic and English texts, the Arabic text prevails.