TULA-HAU Privacy Policy

Last updated: October 21, 2026

1. Introduction

TULA-HAU respects your privacy and is committed to handling personal data responsibly.

This Privacy Policy applies to the TULA-HAU website, Passenger app, Driver app, Merchant app, and related services operated by:

TULA HA'U TRANSPORTE, UNIPESSOAL, LDA.

Registered office: 30 de Agosto, Comoro, Dom Aleixo, Díli, Timor-Leste.

Company identification number (NIF): 1453233.

Contact email: tulahau25@gmail.com

This Policy explains the categories of personal data we process, the purposes of processing, disclosures to service providers, retention practices, and the choices available to you.

2. Scope and Age Requirements

TULA-HAU services are intended for individuals aged 18 or older.

We do not knowingly permit individuals under 18 to create accounts or use services that require an adult account.

If we become aware that an account belongs to a person under 18, we may restrict the account and take appropriate steps to address the situation in accordance with applicable law.

If you believe a person under 18 has provided personal data to us, contact tulahau25@gmail.com.

3. Personal Data We Collect

The data we process depends on the application you use, the services you request, your permissions, and your interactions with TULA-HAU.

3.1 Account and Profile Information

We may process:

Name and username.
Phone number and email address.
Account identifiers.
Profile information.
Account preferences and status.

For drivers, we may also process driving licence details, vehicle information, and documents needed to verify eligibility and compliance.

For merchants, we may process business names, contact details, store information, and documents required to verify the business or its representatives.

3.2 Authentication Information

If you sign in using a phone number, username, Google, or Facebook, we process the information necessary to authenticate your account and maintain access securely.

Depending on the sign-in method, this may include a provider-issued account identifier, email address, name, or other profile information authorized by you and made available by the provider.

Authentication providers may process data under their own privacy policies.

We do not ask you to provide your Google or Facebook password directly to TULA-HAU.

3.3 Location Information

Depending on your permissions and service use, we may process:

Current device location.
Selected pickup and destination locations.
Driver location while the driver is online or fulfilling a trip or delivery.
Route, distance, and trip progress information.
Delivery addresses and relevant location instructions.

Location information is used to match passengers with drivers, facilitate pickups and deliveries, estimate routes, display trip progress, and support service operations and safety.

Location collection depends on the features used and the permissions granted through your device. You can change location permissions in your device settings, although certain features may not work without them.

3.4 Trips, Bookings, and Orders

We may process information relating to rides, deliveries, and purchases, including:

Booking and order identifiers.
Pickup and destination addresses.
Trip and delivery times.
Fare, delivery fee, product price, and payment status.
Order contents and merchant information.
Cancellation and dispute records.
Relevant service communications.

This information is used to provide services, calculate charges, handle disputes, maintain records, and improve operational reliability.

3.5 Payments and Financial Records

We may process payment method information, transaction references, amounts, payment status, refund information, and related records.

Where payments are handled by a third-party provider, that provider may collect and process payment information under its own privacy policy.

Cash transactions may also generate records needed for fare reconciliation, accounting, support, and dispute resolution.

3.6 Messages, Calls, Ratings, and Support

Depending on the features available, we may process:

In-app chat messages.
Ratings, reviews, and comments.
Customer support requests.
Safety reports and complaints.
Call connection or technical records associated with in-app communications.

Voice communications may be facilitated by a third-party communications provider. Whether audio recordings or detailed call records are stored depends on the actual service configuration.

3.7 Device and Technical Information

We may process:

Push notification tokens.
Device and application identifiers.
Application version and technical diagnostics.
Security logs and information necessary to investigate errors, abuse, or unauthorized access.

This information supports account security, notifications, troubleshooting, and service reliability.

3.8 Information Stored on Your Device

Certain information, such as saved places and recent searches, may be stored locally on your device.

Where such information is stored only on your device, uninstalling the app or clearing its local data may remove it. This does not necessarily delete information already transmitted to or stored on TULA-HAU's servers.

4. How We Use Personal Data

We may use personal data for the following purposes:

Create, authenticate, and maintain accounts.
Match passengers with drivers and facilitate rides.
Coordinate parcel, food, and shop deliveries.
Display trip progress, pickup details, and relevant location information.
Calculate and process fares, fees, and payments.
Communicate booking, delivery, account, and service updates.
Enable communication between relevant users during a trip or order.
Provide customer support and resolve complaints.
Investigate fraud, misuse, security incidents, and safety reports.
Maintain necessary business, accounting, transaction, and operational records.
Meet applicable legal obligations and respond to lawful requests.
Maintain, troubleshoot, and improve the reliability and security of our services.

We will not use personal data for purposes that are incompatible with the purposes described in this Policy unless permitted or required by applicable law.

5. Legal Grounds for Processing

Where applicable law requires a legal basis for processing, we will rely on the relevant basis depending on the circumstances, which may include:

Performing a contract or taking steps requested before entering into a contract.
Complying with legal obligations.
Protecting individuals' vital interests in appropriate emergencies.
Legitimate interests in platform security, fraud prevention, service reliability, and dispute resolution, where permitted and balanced against individual rights.
Consent, where required for particular processing activities.

Where processing relies on consent, you may withdraw consent where applicable. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Share Personal Data

We may disclose relevant personal data to the following categories of recipients.

6.1 Passengers, Drivers, and Merchants

Information may be shared between users when necessary to complete a trip or order.

For example:

A passenger may see the assigned driver's name, vehicle details, and trip location.
A driver may see the passenger's name, pickup point, destination, and relevant contact information.
A merchant may see order details, delivery instructions, and information necessary to fulfil an order.
A delivery provider may receive the information required to complete a delivery.

We aim to limit shared information to what is reasonably necessary for the relevant service.

6.2 Technology and Service Providers

Depending on the features actually enabled, TULA-HAU may use providers for:

Authentication and account management, including Google Firebase Authentication.
Google or Facebook sign-in integrations.
Push notifications.
In-app communications, including Agora where enabled.
Place search and geocoding, including Photon by komoot where enabled.
Hosting, infrastructure, monitoring, and technical support.
SMS delivery and payment processing, where applicable.

These providers may process data on our behalf or independently under their own terms, depending on the service.

The exact list of providers and their functions may change as the platform develops. We will update this Policy when material changes require disclosure.

6.3 Legal, Safety, and Regulatory Disclosures

We may disclose information where reasonably necessary and legally permitted to:

Comply with applicable laws or lawful orders.
Respond to competent authorities.
Investigate fraud or security incidents.
Protect the rights, safety, and property of users or other persons.
Establish, exercise, or defend legal claims.

We will assess requests appropriately and disclose only information that is legally permitted or required.

6.4 Business Transfers

If the business undergoes a merger, restructuring, financing, or transfer of relevant operations, personal data may be disclosed or transferred where necessary and lawful, subject to appropriate safeguards and applicable privacy requirements.

7. Sale of Data and Advertising

Policy commitment: TULA-HAU does not sell personal data to third parties for money.

TULA-HAU does not use precise location data or personal trip histories for targeted advertising as a stated policy.

If advertising, analytics, or promotional technologies are introduced, we will assess their privacy implications, update this Policy where necessary, and obtain consent where required by law.

8. International Data Transfers

Some service providers may process or store data in countries outside Timor-Leste.

Where personal data is transferred internationally, we will take steps required by applicable law to protect the information and ensure that the transfer has an appropriate legal basis and safeguards.

The location and applicable safeguards depend on the service providers and infrastructure actually used.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal requirements.

Retention depends on the type of information and the circumstances.

Account data: retained while an account is active and for a reasonable period afterward where necessary for security, support, legal compliance, or dispute resolution.
Driver and merchant verification records: retained for as long as necessary to verify eligibility, maintain platform safety, and meet applicable legal requirements.
Trip, delivery, and order records: retained for operational, customer support, accounting, and dispute-resolution purposes.
Payment and accounting records: retained for periods required by applicable financial, tax, and accounting rules.
Safety, fraud, and complaint records: retained for as long as reasonably necessary to investigate incidents, protect users, and establish or defend legal claims.
Technical and security logs: retained according to operational and security needs and any applicable legal requirements.
Locally stored device information: may remain on your device until deleted by you or removed through device or app-data management.

When information is no longer needed and no lawful retention requirement applies, we will delete it or take appropriate steps to anonymize it.

We will establish and maintain internal retention periods for each category of data. Where deletion of an account is requested, some records may be retained only to the extent permitted or required by law and for the purposes described above.

10. Account Deletion and Your Privacy Rights

Subject to applicable law, you may request:

Access to personal data concerning you.
Correction of inaccurate or incomplete information.
Deletion of personal data.
Withdrawal of consent where processing is based on consent.
Information about how your data is processed.
Other rights available under applicable law.

To request deletion, follow the instructions at:

https://tulahau.com/data-deletion/

You may also contact tulahau25@gmail.com.

We may need to verify your identity before acting on a request. We will not ask you to provide your account password.

Some information may need to be retained for lawful accounting, security, fraud-prevention, or dispute-resolution purposes. Where applicable, we will explain relevant limitations.

11. Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure.

These measures may include encrypted connections, access controls, authentication safeguards, and security monitoring, depending on the system concerned.

No internet transmission or storage system can be guaranteed to be completely secure.

We will handle suspected personal data incidents in accordance with our internal procedures and applicable legal obligations.

12. Children's Privacy

TULA-HAU services are intended for adults aged 18 or older.

We do not knowingly permit children under 18 to register for services that require an adult account. If we become aware that personal data has been collected from an underage account contrary to this Policy, we will assess the situation and take appropriate action in accordance with applicable law.

13. Third-Party Websites and Services

Our website or applications may link to third-party websites or services.

Their privacy practices are governed by their own policies. We encourage users to review those policies before providing personal information directly to third parties.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, data practices, or applicable law.

The latest version will be published on:

https://tulahau.com/privacy-policy/

The revision date will be updated when material changes are made. Where required, we will provide additional notice or seek consent.

15. Contact Us

For privacy questions, access requests, corrections, complaints, or deletion requests, contact:

TULA HA'U TRANSPORTE, UNIPESSOAL, LDA.

Registered office: 30 de Agosto, Comoro, Dom Aleixo, Díli, Timor-Leste.

Email: tulahau25@gmail.com

Website: https://tulahau.com/

Data Deletion Instructions: https://tulahau.com/data-deletion/