Privacy Policy

1. Introduction

This Privacy Policy explains how TheMoveo (Pvt) Ltd ("themoveo", "we", "us" or "our"), a company registered in Sri Lanka under Business Registration No. PV00362879, with its registered office at 102/1 MPCS Road, Akkaraipattu-2, Sri Lanka, collects, uses, discloses and protects the personal information of customers, riders, drivers and food merchant partners ("you") who use the themoveo app and website (together, the "Platform"). By creating an account, granting location or notification permissions, or otherwise using the Platform, you consent to your information being collected, used and disclosed as this Policy describes. If you do not agree with this Policy, please do not use the Platform.

2. Information We Collect

2.1 Information you provide

• Full name and date of birth
• Phone number and email address
• Profile photo (optional)
• Government-issued ID and vehicle documents (for driver partners)
• Business registration and menu details (for merchant partners)

2.2 Information collected automatically

• Pickup, drop-off, and delivery addresses, and real-time GPS location while the app is in use
• Order and trip metadata: items ordered, fare, driver/merchant ID, timestamps, route taken
• Device identifier, IP address, app version, and crash/usage analytics

2.3 Payment information

themoveo supports card payment, cash on delivery and cash on ride. For card payments, themoveo does not store, capture or handle full card numbers, CVV codes or other sensitive cardholder data on its own servers: card transactions are processed through PayHere's PCI DSS-compliant, SSL-encrypted payment gateway, and we receive only a transaction reference and confirmation status, while cardholder details stay within PayHere's own infrastructure. For cash on delivery and cash on ride, no card data is collected at all, only the transaction amount and its settlement status.

2.4 Verification & safety data

For driver Partners, we may collect a live selfie photo for identity verification against submitted ID documents, and safety-related data such as trip recordings made by in-vehicle dashcams (see Section 7).

3. Legal Basis for Processing

We process your personal data on the following legal bases recognized under the PDPA:

• Performance of a contract — to create your account and fulfil Orders and Rides
• Consent — for optional features such as marketing communications and profile photos
• Legitimate interests — to keep the Platform secure, prevent fraud, and improve our services, balanced against your rights
• Legal obligation — to comply with tax, safety, and regulatory requirements under Sri Lankan law

4. How We Use Your Information

• Match customers with drivers and food merchants, and facilitate order and ride fulfilment
• Process payments and cash settlements, and issue receipts
• Verify driver and merchant identity, documents, and eligibility
• Provide customer support and resolve disputes
• Send order/ride updates, receipts, and service notifications
• Detect and prevent fraud, abuse, and misuse of the Platform
• Improve the Platform through aggregated, anonymized analytics

We do not sell your personal data, and we do not share it with third-party advertisers. Information is disclosed only as described in this Policy or with your explicit consent.

5. Who We Share Information With

• Drivers and merchants — limited to what's needed to fulfil your order or ride (e.g. name, phone number, pickup/delivery address). Once shared, a Partner's use of your information is governed by their own practices, and themoveo is not responsible for a Partner's independent misuse of information disclosed to them for order/ride fulfilment.
• PayHere — for processing card payments, governed by PayHere's own privacy policy
• Service providers — cloud hosting, SMS/notification, and analytics providers bound by confidentiality and data-processing obligations
• Law enforcement or regulators — where required by Sri Lankan law, a court order, or to protect the safety of any person
• Successors — in connection with a merger, acquisition, or sale of assets, subject to equivalent confidentiality protections

6. Location Data & Safety

Real-time GPS location is collected while the app is in use to match you with a Partner, calculate routes and fares, and enable safety features (such as trip sharing and emergency assistance). Location data is shared with the relevant driver or merchant for the duration of an active Order or Ride, and may be disclosed to law enforcement in connection with a safety incident or upon lawful request.

7. In-Trip Safety Recording

Some driver Partners may use dashcams or similar devices that record audio and/or video during a Ride for safety and dispute-resolution purposes. Such recordings are controlled by the relevant Partner and may be shared with themoveo, law enforcement, or an insurer in connection with a safety incident, complaint, or legal claim.

8. Marketing Communications & Opt-Out

With your consent, we may send you promotional messages about new features, offers, or partner promotions via email, SMS, or push notification. You can opt out of marketing communications at any time through the app settings or the unsubscribe link in any marketing email. You will continue to receive essential transactional notifications (such as order and ride updates) even after opting out of marketing.

9. Data Retention

We retain personal data for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Order and trip records are generally retained for up to 5 years in line with Sri Lankan financial record-keeping requirements, and may be retained longer where required for an active legal claim or regulatory investigation. You may request earlier deletion subject to Section 14.

10. Data Security

We apply industry-standard technical and organizational safeguards, including encryption in transit, access controls and regular security reviews, to protect your data against unauthorized access, loss or misuse. That said, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. If a data breach affects your personal data, we will notify you and the relevant authority as required under the PDPA. Our liability for a data security incident is, so far as the law allows, subject to the limits set out in our Terms & Conditions, except where the incident results from themoveo's own gross negligence or willful misconduct.

11. International Data Transfers

Some of our service providers, such as cloud hosting and analytics providers, may process data on servers located outside Sri Lanka. Where that happens, we take reasonable steps, including contractual safeguards with those providers, to keep your data protected to a standard consistent with this Policy and the PDPA.

12. Automated Decision-Making

The Platform uses automated processes to match Customers with available drivers and merchants, estimate fares and delivery times, and flag potentially fraudulent activity. These processes support, but do not replace, human review before any decision with a significant effect on you, such as permanent account deactivation, is finalized.

13. Cookies & Tracking

Our website and app use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used. You can control cookies through your browser or device settings, though disabling them may limit certain features.

14. Your Rights

In accordance with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data, subject to legal retention requirements
• Object to or restrict certain processing of your data
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at support@themoveo.com. We will respond within the timeframes required by applicable law. themoveo may decline requests that are manifestly unfounded, excessive, or repetitive, or charge a reasonable fee, to the extent permitted under the PDPA, and may require proof of identity before actioning a request.

15. Children's Privacy

The Platform is not intended for individuals under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that a minor has provided us with personal data, we will take steps to delete it. Parents or guardians who believe a minor has provided us with personal data should contact us immediately.

16. Third-Party Links & Services

The Platform may contain links to, or integrate with, third-party services such as PayHere. themoveo is not responsible for the privacy practices, content, or security of any third-party service, and your use of such services is governed by their own terms and privacy policies.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified through the app or by email. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

18. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact our Data Protection Officer:

TheMoveo (Pvt) Ltd
102/1 MPCS Road, Akkaraipattu-2, Sri Lanka
Email: support@themoveo.com
Phone: +94 77 633 2217