Privacy policy
This policy explains, clearly and in detail, which personal data RAYA collects, why it is processed, who receives it, how long it is kept, and the rights available to each data subject.
Version privacy-2026-09-a, effective 2026-09-21
1Controller and contact details
This policy is issued by Raya, registered in the commercial register of the Syrian Arab Republic under number 0310107352, the operator of the RAYA platform and the controller of the data processed on it, referred to in this policy as “RAYA”. Privacy enquiries and requests may be sent to info@mhd-shekho.com. Passwords, verification codes and document images must not be sent through that channel.
2Scope and allocation of responsibility
RAYA is responsible for processing account data, platform security, search and booking records, platform-service billing, compliance and oversight. The selected rental company is independently responsible for the data it needs to perform the rental contract, inspect the physical driving licence at handover, manage the vehicle and sums paid to it, and resolve rental disputes. Where a rental company uses RAYA's software for customers it sourced itself, RAYA processes that data for the company under the documented instructions in the commercial terms.
3Categories of data processed
Data may include names, email addresses, telephone numbers and language; account, authentication, session and device data; typed driver details such as date of birth, nationality, licence number, issuing country and expiry; search, booking, vehicle, branch, price and recorded cash-transaction details; support and dispute correspondence; rental-company, representative, staff and business-verification records; and security, audit, network-address and request-identifier logs. RAYA does not ask customers to upload identity or licence images and does not collect payment-card data because customers pay the rental company outside the platform.
4Sources of data
We obtain data directly from you, from a rental company when it manages a booking or agreement, automatically through use of the platform and its security controls, or from Telegram only when you choose to share your number with the RAYA bot for verification. We do not buy personal-data lists or extract contacts from your device.
5Purposes and lawful grounds
We process data to create and protect accounts; verify contact channels; list vehicles, quote, book and perform contracts; enable handover and return by the rental company; issue records and invoices; prevent and investigate fraud and misuse; support users; meet legal obligations; and prove consents and transactions. Depending on the activity, the ground is performance of a contract or requested pre-contract steps, a legal obligation, a proportionate legitimate interest in protecting the service and legal rights, or explicit consent where the law requires it. Direct marketing is separate and optional and is not a condition of an account or booking.
6Recipients and disclosures
We share with the selected rental company only what is necessary to perform its booking, and do not disclose customer data to a company before there is a confirmed booking belonging to it. We may use hosting, email, communications and security providers bound by contractual and confidentiality duties, and Telegram when you use its verification route. We may disclose what a competent public authority lawfully requires or what is necessary to protect a legal right. We do not sell personal data or make it available to advertising companies.
7Third-party service providers
Platform data is stored and processed by third-party infrastructure and service providers acting on RAYA's instructions, bound by contract to confidentiality and appropriate security safeguards, and not permitted to use the data for their own purposes. Where Telegram or email services are used, their processing is governed by the relevant provider's policy.
8Retention periods
Account data is kept while the account remains open and afterwards for the period needed to close it, settle claims and comply with law. Bookings, agreements, invoices, financial records, consent evidence and audit records remain for the period required for proof, accounting and disputes; they are not erased merely because an account closes, but data is reduced or irreversibly anonymised where the law allows. Login codes, temporary links and sessions expire under their technical lifetimes, and security logs are deleted or de-identified under a restricted retention schedule. Evidence of marketing consent or withdrawal is retained for at least three years, or longer where law or a pending dispute requires it.
9Data security
We apply proportionate technical and organisational measures, including encryption in transit, tenant and privilege separation, multi-factor authentication for staff, access controls, audit records, backups and abuse monitoring. No electronic method can eliminate all risk; controls are therefore reviewed and updated, and collection is limited to what is actually required.
10Data-subject rights
Subject to applicable legal conditions, you may request information about processing, its purposes, sources, recipients and retention; access and receive a copy of your data; correct or update it; erase data for which no lawful retention ground remains; restrict or object to processing; withdraw consent without affecting earlier lawful processing; and complain to the competent authority. Requests are made through the support button on the platform or to the email address above. We reply to every request within twenty-four hours of receiving it, and may require proportionate proof of identity before disclosing data.
11Account closure and erasure
Closing an account disables its use and starts data reduction or anonymisation. Erasure does not extend to a record that must lawfully be retained, an agreement, invoice, booking, audit trail, or evidence of a transaction or dispute. Use of retained data is then restricted to the lawful retention purpose and it is not used for marketing.
13Automated processing
The platform uses automated rules to calculate availability and prices, prevent duplicate bookings and detect misuse. It does not make a solely automated profiling decision that by itself produces a material legal effect on a person. Rental-company approval or suspension and material disputes are subject to human review.
14Minors
The rental service is intended for persons with legal capacity, a valid driving licence and the rental company's applicable minimum age. We do not knowingly create a rental account for a minor. If data concerning a minor is incidentally processed in a support or company relationship, a lawful basis and guardian consent are required where the law so provides.
15Personal-data breaches
We assess, contain and document any incident affecting personal data. Where required by law, we notify the competent authority promptly and provide particulars within seventy-two hours, and notify affected persons within three working days where their rights or freedoms are affected, by a message in their platform inbox and by email where possible, explaining the nature, consequences and mitigation.
16Changes and versions
Each policy has a version and effective date. Earlier versions are retained where needed to prove what was displayed. A material change is announced through an appropriate channel before it takes effect, and fresh consent is requested if a consent-based purpose changes. Processing needed for an existing contract or by law does not depend on marketing consent.