1.1. This Privacy Policy (“Policy”) explains how Lux Rent Dubai (“we”/“the Company”) collects, uses, discloses, stores, and protects personal data of clients and guests when you book and receive car rentals, yacht charters, and helicopter tours/charters in Dubai.
1.2. We act in accordance with Federal Decree-Law No. 45/2021 (PDPL) and other applicable laws of the UAE, including DMCA, GCAA, and RTA/Salik regulations.
1.3. By using our services or website, you agree to the processing of your data in accordance with this Policy.
The scope of information depends on the service you choose. We may process the following categories of data:
Identification and contact data: full name, date of birth, nationality, passport/Emirates ID number, visa (residence or visit), driving license (and IDP), document copies, residential address, email, phone number.
Booking and service data: rental dates and locations, vehicle class, yacht type/itinerary, helicopter route, guest lists for yacht trips, age confirmation (21+ for alcohol), passenger weight for helicopter tours (required for balance calculation; maximum individual weight 115 kg, passengers above 140 kg are not permitted).
Payment data: card details, rental cost and deposits (blocked via payment gateway), payment history, Salik toll records, traffic fines.
Technical data: IP address, browser type, device, cookies/pixels, visit logs (for analytics and site improvement).
Accident/claims data (cars): police reports, fines/damage reports, insurance documents.
Safety data: passenger lists, weight information, medical clearances (e.g., pregnancy certificate for 7+ months for helicopters), compliance with DMCA requirements (lifejackets, alcohol restrictions).
We collect data:
Directly from you during booking, check-in, contract signing, or communication via website/messengers.
From partners (tours, hotels, concierge services) upon your request.
From government bodies and infrastructure operators: RTA/Salik (toll and fines), DMCA (passenger and crew lists), GCAA (identification and weight for flights).
From technical sources (cookies, log files).
We process personal data strictly for:
Contract execution: booking confirmation, voucher issuance, invoicing, deposits, refunds, post-billing for Salik/fines.
Identification and legal compliance: verifying documents, driving experience, age and weight restrictions (helicopters), DMCA alcohol policy, lifejackets on yachts, GCAA/DMCA compliance.
Communication: booking confirmations, schedule/route changes due to weather, ATC or port requirements; deposit refund notifications.
Safety and fraud prevention: access control, CCTV/dashcam monitoring, disclosure to law enforcement when required.
Marketing and service: sending offers and news with your consent (you may opt out at any time).
Analytics and improvement: service optimization and website enhancement based on anonymized data.
Under the PDPL, we rely on the following legal grounds:
Contract performance – necessary for bookings and service delivery.
Legal obligations – compliance with DMCA/GCAA/RTA/Salik and other regulators.
Legitimate interests – ensuring safety, preventing fraud, enforcing fines.
Consent – for marketing communications and processing sensitive data (e.g., passenger weight).
Vital interests – in emergencies at sea or in the air.
We do not sell or rent your data. We may share data with:
Payment providers and banks – to process payments and deposits.
Service and partner companies – yacht crews, helicopter operators, transfers, catering, insurers, maintenance services.
Government authorities – RTA/Salik, DMCA, GCAA, police, courts, if required by law or for safety.
IT service providers – hosting, CRM, analytics, messenger services (bound by confidentiality obligations).
Successors – in case of merger, reorganization, or business sale, subject to PDPL compliance.
We may transfer data outside the UAE (e.g., cloud hosting). In such cases, we ensure an equivalent level of protection through data transfer agreements and mechanisms approved under PDPL.
Booking and financial records – at least [__] years for compliance and accounting.
Deposit information – up to 30 days after rental completion, then deleted.
Safety/incident records (CCTV, accident reports) – up to [__] months or longer if legally required.
Marketing data – until withdrawal of consent or end of subscription.
We regularly review retention periods and delete or anonymize data where possible.
We use cookies and similar technologies for:
Site functionality and security.
Traffic analysis and UI improvement.
(With your consent) personalized marketing.
You may configure your browser to block cookies, but this may limit website functionality.
Under the PDPL, you have the right to:
Access your data and learn what we store and why.
Correct or delete inaccurate or outdated data.
Object to or restrict processing in certain cases.
Request data portability to another controller, where technically feasible.
Opt out of direct marketing – we will stop sending promotional messages.
File complaints with the competent authority.
To exercise your rights, send a request to [your PDPL/DPO email].
We collect document copies (passport, Emirates ID, driving license) and security deposits.
We process Salik toll data (shared by RTA/Salik for billing).
We may store police/insurance reports on accidents, fines, and damages.
Prior to departure, we collect guest lists and confirm age (21+) for alcohol policy compliance.
DMCA requires lifejackets for all passengers, especially children; compliance records may be kept.
Crew and inventory logs (lifejackets, extinguishers) may be submitted to authorities.
Booking requires full name, passport/ID, and exact weight of each passenger; arrival 45 minutes before flight.
Restrictions: individual weight ≤115 kg, maximum weight 140 kg; group weight approx. 420–450 kg.
Weight data is deleted after the flight unless legally required (e.g., investigations).
We apply technical and organizational safeguards: encryption, secure connections (SSL/TLS), firewalls, access control, staff training, regular audits. Data is stored in the UAE or jurisdictions with adequate protection. We use PCI-DSS-compliant payment gateways. However, no method is 100% secure. In case of a data breach, we notify authorities and, if required, affected individuals.
Our services are not intended for individuals under 18 (car rentals) and under 2 (helicopter tours). We do not knowingly collect children’s data without parental/guardian consent and comply with regulatory requirements.
Our website may contain links to third-party sites (payment forms, map services, etc.). We are not responsible for their privacy policies. Please review those before sharing your data.
We may update this Policy. The effective date will be indicated at the top. If significant changes are made, we will notify you via the website or email. Continued use of our services constitutes your acceptance of the updates.
