Article 1 — Introduction
Dubai Rental Cars (“the Company”, “we”, “us”) operates the website dubairentalcars.com and provides passenger vehicle rental services in the Emirate of Dubai. The Company is part of the DriveX group of companies. This Privacy Policy explains the personal information we collect, how we use it, the legal bases that permit such use, the third parties with whom it is shared, and the rights available to you under applicable UAE and international data protection laws, in particular the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”).
This Policy applies to all visitors to the website and to all customers who complete a rental booking through any of our channels. By using the website or submitting personal information to us, you consent to the practices described here. Our Terms and Conditions govern the rental relationship itself and should be read alongside this Policy.
Article 2 — Personal Information We Collect
We collect only the personal information necessary to operate our rental business, to comply with our regulatory obligations, and to provide the services described in these Terms. The categories of information we typically collect are:
2.1 Identity and Contact. Your full name (as it appears on your driving licence), date of birth, nationality, residential and billing addresses, email address, mobile telephone number, and — for corporate bookings — employer or company name.
2.2 Driving Licence and Identification. Copies of your driving licence, your passport or Emirates ID, and — for visitors — your International Driving Permit where applicable. Originals are returned at the time of rental; copies are held in encrypted form for the retention period in Article 7.
2.3 Booking and Rental Transaction. Booking reference, vehicle category and specific vehicle identification, rental period, pickup and return locations, optional extras, agreed rental rate, and the condition reports completed at the start and end of the rental.
2.4 Payment Information. Cardholder name, billing address, and a tokenised reference to your card. We do not store full card numbers on our own systems; card data is processed through a PCI-DSS-compliant payment gateway.
2.5 Telematics. Most vehicles are equipped with telematics that record vehicle location, speed, and operational data for fleet management and theft recovery. Telematics data is associated with your identity only where there is a legitimate reason, such as a damage claim or traffic fine dispute.
2.6 Communications and Technical Data. Telephone calls (which may be recorded for quality and dispute resolution), WhatsApp and email correspondence, and the technical information (IP, browser, device) collected by our hosting infrastructure and analytics tools when you visit the site.
Article 3 — How We Use Your Information
We process your personal information only for specified and lawful purposes, on the lawful bases of the performance of a contract with you, compliance with a legal obligation, our legitimate interests as a business, or your express consent. The principal purposes are: to perform the rental agreement and to deliver the vehicle; to verify your eligibility to rent under RTA and insurance requirements; to process payments and to administer the security deposit; to handle insurance claims; to detect and prevent fraud; to allocate Salik, traffic fines, and parking charges to the correct rental period; to respond to enquiries and to resolve disputes; to send marketing communications where you have opted in; to operate and secure the website; and to maintain the records required by UAE tax and company law.
Article 4 — Cookies and Tracking Technologies
We use cookies and similar technologies for the following purposes. Strictly necessary cookies manage your session and protect the site against abuse; they cannot be switched off. Functional cookies remember your language and currency preferences. Analytics cookies, operated by Google Analytics 4 with IP anonymisation and a fourteen-month retention period, allow us to understand aggregate site usage. Marketing cookies, operated by Meta and Google Ads, allow us to measure the effectiveness of our advertising; these are placed only after you have given your consent through the cookie banner. You may withdraw your consent at any time through the cookie preference centre on the site or through your browser settings.
Article 5 — Data Sharing and Third-Party Recipients
We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We share personal information only with the following categories of recipients, each of whom is bound by a written agreement requiring equivalent security safeguards: payment processors (PCI-DSS-compliant); insurance providers and claims handlers; UAE government authorities including the RTA, Dubai Police, and Salik, where required by law; telematics providers; analytics and marketing platforms (only where you have consented); IT and cloud service providers; other DriveX group companies for limited operational purposes; and professional advisers and successors in the event of a sale or restructuring of the business.
Article 6 — International Data Transfers
Our primary infrastructure is in the UAE and, for certain services, in the European Union. Where a transfer of personal information to a jurisdiction outside the UAE takes place, we rely on standard contractual clauses, written data processing agreements, and the regional data-localisation options offered by vendors. We will provide further information about the safeguards relied on for any specific transfer on request, subject to any confidentiality obligations owed to our vendors.
Article 7 — Data Retention
We retain personal information only for as long as is necessary for the purposes for which it was collected and to comply with our legal obligations. The principal retention periods are:
7.1 Active Booking and Rental Records. Retained for the duration of the rental plus thirty days to allow reconciliation of post-rental Salik, fines, and parking penalties (subject to RTA and Dubai Police update delays), after which identifying elements are removed.
7.2 Customer Account Records. Retained for seven years from the date of your last rental, in line with UAE Federal Tax Authority guidance for financial and tax records. After seven years of inactivity, account information is securely deleted.
7.3 Call Recordings. Retained for thirty days and then automatically deleted, unless required for an open complaint or investigation.
7.4 Marketing Data. Retained until you withdraw your consent; deleted within thirty days of withdrawal.
7.5 Technical Logs. Retained for ninety days for security and troubleshooting, after which they are deleted.
Article 8 — Data Security
We protect personal information with a layered set of technical and organisational measures. All information transmitted between your device and our website is encrypted using TLS 1.2 or higher; personal information held at rest is encrypted using AES-256 or equivalent. Access to production systems is restricted by role-based access control and multi-factor authentication. Our public-facing website is protected by a web application firewall, by Cloudflare bot-mitigation, and by routine penetration testing conducted by independent firms. Card data is processed through a PCI-DSS-compliant gateway and is never stored on our own systems. Internal access is granted on a need-to-know basis, and staff are required to complete annual data protection training. We maintain a documented incident response plan; in the event of a personal data breach presenting a risk to your rights, we will notify the relevant UAE supervisory authority without undue delay and, where the risk is high, we will notify affected individuals directly.
Article 9 — Your Privacy Rights
Under the UAE PDPL and analogous international regimes, you have the following rights in respect of the personal information we hold about you. We aim to respond to valid requests within thirty days of receipt.
9.1 Access. Confirmation of whether we are processing personal information about you, and a copy of that information in a structured, machine-readable format.
9.2 Rectification. Correction of personal information that is inaccurate, and completion of information that is incomplete.
9.3 Erasure. Deletion of your personal information where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and we have no other lawful basis, or where you have successfully objected to processing. The right does not apply where retention is required for legal compliance or for the establishment or defence of legal claims.
9.4 Restriction and Objection. Restriction of processing while we verify a contested accuracy claim, and objection to processing based on our legitimate interests.
9.5 Portability. Receipt of the personal information you have provided to us in a structured, commonly used, and machine-readable format, where the processing is based on your consent or on the performance of a contract with you and is carried out by automated means.
9.6 Withdraw Consent. Withdrawal of consent for marketing communications and for non-essential cookies at any time, without affecting the lawfulness of processing carried out before your withdrawal.
9.7 Complaint. Lodging of a complaint with the competent UAE supervisory authority if you believe that our processing infringes the PDPL. We would, however, appreciate the opportunity to investigate your concern internally before you approach a regulator.
To exercise any of these rights, please send a written request to the email address shown in Article 10 with the subject line “Data Subject Request”. We will verify your identity before disclosing any personal information and do not charge a fee, except where a request is manifestly unfounded, excessive, or repetitive.
Article 10 — Children, Marketing, and Changes to This Policy
Our services are not directed at persons under the age of twenty-one, which is the minimum age to rent a vehicle in the UAE. We do not knowingly collect personal information from individuals under twenty-one; if we become aware that we have done so inadvertently, we will delete the information without delay. We send marketing communications only where you have given your prior opt-in consent, and you may withdraw that consent at any time through the unsubscribe link in any message or by contacting us directly. We may update this Policy from time to time; the “last updated” date above indicates when the current version took effect. Material changes will be notified to active customers by email not less than thirty days before they take effect, and a notice will be displayed on our website during the same period.
Article 11 — Contact Information
If you have any questions, requests, or complaints regarding this Privacy Policy, please contact us. We aim to acknowledge all enquiries within two working days and to respond in full within seven working days. Please also refer to our Terms and Conditions for the contractual terms of the rental, or return to the home page.
| Data Controller | Dubai Rental Cars (part of the DriveX group of companies) |
| Registered Address | Office #48, 21st Floor, Binary Tower by Omniyat, Business Bay, Dubai, United Arab Emirates |
| Email (General) | info@dubairentalcars.com |
| Telephone | +971 56 121 5152 |
| Customer Service Hours | Monday to Saturday, 09:00–18:00 (Gulf Standard Time) |
| Last Updated | 21 September 2026 |