Privacy Policy

1. PURPOSE AND STATUS OF THIS PRIVACY POLICY

This Privacy Policy explains how Imperial Premium Rent a Car LLC (the “Company”, “we”, “us” or “our”) collects, uses, records, stores, shares, transfers and otherwise processes Personal Data in connection with its vehicle-rental, chauffeur, transfer and related services, its website at www.imperial-rac.com, bookings, rental agreements and other dealings with individuals.

The Company is the Controller of Personal Data for the processing described in this Privacy Policy, except where another person independently determines the purposes and means of processing, such as a competent government authority, insurer, bank, card issuer or payment provider acting in its own capacity.

This Privacy Policy is intended to provide the information required by Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, any implementing regulations issued under it and other Applicable Law governing personal data protection in the UAE (together, the “UAE Data Protection Law”). Where another data-protection law mandatorily applies to particular processing, the Company will comply with that law to the extent required. This Privacy Policy does not voluntarily submit the Company to a foreign law that would not otherwise apply.

This Privacy Policy describes processing; it does not by itself create a contractual right, expand the Company’s rights under a rental agreement or constitute consent where consent is not required or has not validly been obtained. The Company’s rental Terms and Conditions continue to govern the Booking, Agreement, Vehicle, Vehicle Data and related rights and obligations. The separate Website Terms of Use govern use of the website, and the separate Cookie Policy gives further information about cookies and similar technologies. If a term used in this Privacy Policy is defined in the applicable rental Terms and Conditions, that definition applies where the context concerns a Booking or Agreement.

2. WHO AND WHAT THIS PRIVACY POLICY COVERS

This Privacy Policy applies to Personal Data processed by the Company about:

(a) persons who request a quotation, make or pay for a Booking, enter into or perform a rental Agreement, or use a Vehicle;

(b) Renters, intended and approved Authorised Drivers, Additional Drivers, Cardholders, Guarantors, corporate representatives and persons who receive or return a Vehicle;

(c) passengers and other persons whose information is reasonably required for chauffeur, transfer, delivery, collection, roadside-assistance, insurance or claims services;

(d) persons who communicate with the Company by website form, email, telephone, WhatsApp, Telegram, SMS, social media or in person;

(e) website visitors and persons who interact with the Company’s advertising, analytics, social-media or digital services;

(f) complainants, claimants, witnesses, injured persons and other persons involved in an Accident, Reportable Event, insurance claim, Fine, Impoundment, payment dispute, chargeback, complaint or legal proceeding; and

(g) representatives of corporate customers, travel managers, travel agents, brokers, suppliers, contractors, service providers and business partners.

This Privacy Policy does not govern processing performed independently by a third-party website, application, social-media platform, bank, card network, insurer, government authority or other independent Controller. Their own notices and terms apply to their processing.

3. MEANING OF PERSONAL DATA

“Personal Data” means any information relating to an identified natural person or to a natural person who can be identified, directly or indirectly, by reference to that information or by combining it with other information. It includes information in paper, electronic, photographic, audio, video and other recorded forms.

Personal Data may include sensitive categories of information where recognised by Applicable Law, including health information, biometric information used for unique identification, and information concerning alleged or established offences. A photograph, video or copy of an identity document is not described as biometric information merely because it contains an image of a face; it becomes biometric information where it is subjected to specific technical processing for the purpose of uniquely identifying or authenticating a person.

Information that has been effectively anonymised so that no individual can reasonably be identified is not Personal Data. Aggregated or statistical information may nevertheless be treated as Personal Data where it can reasonably be linked back to an individual.

4. PERSONAL DATA WE MAY COLLECT

The Personal Data processed in a particular case depends on the person’s role, the requested service, the Vehicle, Applicable Law and what occurs during or after the rental. We may collect the following categories.

4.1 Identity, eligibility and authority information

This may include name, signature, date and place of birth, age, gender where required for identification or insurance, nationality, photograph, passport information, visa or residence status, Emirates ID information, driving-licence information, International Driving Permit information, issuing country and authority, licence category, issue and expiry dates, driving experience, copies or images of documents, and the results of authenticity, eligibility and Rental Registration System checks.

For a corporate customer or representative, it may also include job title, employer, authority to act, trade-licence or registration information, beneficial-owner or authorised-signatory information where required, and supporting corporate documents.

4.2 Contact and account information

This may include residential or business address, delivery and collection address, email address, telephone number, WhatsApp or Telegram details, social-media handle, preferred language and communication channel, customer or account identifier, login information where an account is offered, and records of any change to those details.

4.3 Booking, rental and service information

This may include requested and confirmed Vehicle or Vehicle Category, rental dates and times, Handover and Return details, pickup, delivery and collection locations, flight, hotel or itinerary information voluntarily provided or required for the service, selected extras and protection options, Additional Drivers, Mileage Allowance, rental history, preferences, quotations, Booking Confirmation, Agreement, amendments, extensions, cancellation, No-Show and Failed Handover information.

4.4 Payment, security and transaction information

This may include payer and Cardholder identity, billing address, payment method, masked payment-card number, card type, card issuer and issuing country, tokenised payment credential, Card Authorisation, Pre-authorisation, Security Deposit, transaction reference, payment, refund and chargeback records, bank account or IBAN information where a bank transfer or refund requires it, invoices, receipts and amounts due.

Payment-card information may be collected or processed directly by a bank, acquirer, card network, card issuer, payment gateway or payment-link provider. The Company may receive and retain a masked card number, token, authorisation result, transaction reference and other information necessary to administer the payment and Agreement. The Company does not claim that a payment provider acts solely on the Company’s instructions where that provider independently determines how it processes data to operate its network, prevent fraud or meet legal obligations.

4.5 Vehicle, location and telematics information

A Vehicle may contain manufacturer systems, a Tracking Device, an Immobilisation Device, onboard diagnostics, connected-vehicle systems or other security and telematics systems. They may generate Vehicle Data, including:

(a) location, route, movement, direction, date and time information;

(b) speed, acceleration, braking, mileage, odometer and driving-event information;

(c) fuel or battery-charge level, range, energy use and charging information;

(d) Vehicle condition, warnings, faults, diagnostic codes, tyre or component information and maintenance status;

(e) door, lock, alarm, ignition, access, key, security and immobilisation events;

(f) collision, impact and other Reportable Event information; and

(g) device, system and connectivity status.

Vehicle Data is Personal Data to the extent that it relates or can reasonably be linked to a Renter, Authorised Driver, passenger or other identifiable person. The availability and precision of Vehicle Data vary between Vehicles and systems. The Company does not represent that every category is collected, continuously available or monitored in real time.

The Company does not access the contents of contacts, messages, photographs or other personal content stored on or synchronised from a device or account belonging to a Renter or Authorised Driver merely because it has been connected to a Vehicle. A person connecting a device or account should remove the connection and personal content before Return. The Company may reset or erase an infotainment or connected-vehicle system when preparing the Vehicle for another rental, but is not obliged to inspect such a system for personal content.

4.6 Vehicle condition, inspection and incident information

This may include Vehicle Check Reports, odometer readings, fuel or charge readings, photographs and videos made at Handover, during the rental or at Return, time and location information associated with those records, Damage and cleanliness records, diagnostic information, repair and recovery records, Police Reports, witness information, statements, diagrams, estimates, invoices, assessor reports, insurer correspondence, claims decisions, Fines, Toll Charges, Parking Charges, Impoundment and authority records.

4.7 Images, verification records and CCTV

Where permitted by Applicable Law and reasonably required, the Company may photograph or record the person taking Handover together with the identity document presented, or retain a verification image or video, to verify identity and authority, prevent impersonation and fraud, document delivery or Return, and respond to a dispute or chargeback.

Where CCTV operates at a Company office, parking, garage, Handover or Return location controlled by the Company, images may be recorded for security, safety, access control, fraud prevention, incident investigation and protection of persons, Vehicles and property. CCTV use is subject to any notice displayed at the location and Applicable Law. This paragraph does not suggest that CCTV operates at every location or that the Company controls CCTV operated by a hotel, parking operator, building manager or other third party.

4.8 Communications and customer-service information

This may include correspondence, emails, website-form submissions, WhatsApp, Telegram, SMS and social-media messages, attachments, call date, time, number and routing information, complaints, reviews, survey responses, service requests and internal notes reasonably required to manage the interaction. A call will be recorded only where recording is used and the caller is given any notice required by Applicable Law.

4.9 Website, device, cookie and advertising information

This may include IP address, browser and device type, operating system, language, approximate location derived from IP address, referring URL, pages and Vehicles viewed, searches, clicks, session and attribution information, advertising identifiers, cookie or similar-technology identifiers, consent choices, and technical security and error logs.

4.10 Health, injury and other sensitive information

Where necessary in connection with driver eligibility, an emergency, Accident, PAI, bodily-injury claim, insurance, assistance or a legal requirement, the Company may process limited information concerning illness, impairment, medication, injury, medical treatment, ambulance services or insurance benefits. The Company does not seek unrelated medical information.

Information concerning suspected fraud, theft, traffic violations, Prohibited Use, police or court proceedings, Fines, Impoundment and other alleged or established offences may be processed where relevant to the Agreement, insurance, safety, recovery, legal claims or compliance with Applicable Law.

4.11 Marketing preferences

This may include whether and how a person agreed to receive marketing, the source and date of a consent, preferred channel, campaign and engagement information, interests inferred from interactions where permitted, and opt-out or suppression records.

5. HOW WE OBTAIN PERSONAL DATA

We may obtain Personal Data:

(a) directly from the individual, including through the website, a Booking, an Agreement, a document, an inspection, a communication or an in-person interaction;

(b) from a person acting or appearing to act with authority for the individual, including a corporate customer, employer, travel manager, travel agent, broker, family member, Renter, Additional Driver, Cardholder, Guarantor or authorised representative;

(c) from the Vehicle, a Tracking Device, manufacturer system, telematics, diagnostic, security, toll, parking or connected-vehicle system;

(d) from RTA systems, the Rental Registration System, police, courts, public prosecution, municipalities, transport or traffic authorities, toll and parking operators, licensing bodies and other Competent Authorities;

(e) from insurers, brokers, loss adjusters, assessors, repairers, recovery providers, roadside-assistance providers, garages and other persons involved in a Reportable Event or claim;

(f) from banks, acquirers, payment gateways, payment-link providers, card networks, card issuers and fraud-prevention or identity-verification providers;

(g) from another driver, injured person, witness, complainant, claimant, hotel, concierge, parking operator or service provider involved in the rental or event;

(h) from cookies, analytics, advertising and social-media technologies; and

(i) from publicly available sources where use of the information is lawful and relevant.

A person who provides another individual’s Personal Data must have authority or another lawful basis to do so and must, where required, inform that individual about this Privacy Policy. This does not make the person responsible for processing independently undertaken by the Company.

6. WHY WE PROCESS PERSONAL DATA

We process Personal Data only for specified purposes and to the extent reasonably necessary for those purposes. Depending on the circumstances, the purposes include the following.

6.1 Quotations, Bookings and contract administration

We process Personal Data to respond to enquiries; prepare quotations; check availability; create, confirm, amend, extend or cancel a Booking; provide the Terms and Conditions, Schedule of Charges and other pre-contract information; enter into and administer an Agreement; arrange Handover, Return, delivery, collection, chauffeur, transfer and related services; communicate operational information; and maintain records of acceptance and performance.

6.2 Identity, authority and driver eligibility

We process Personal Data to verify identity, age, authority, licence, driving experience, visa or residence status and other eligibility requirements; authenticate documents; prevent impersonation; approve or reject a proposed driver; and register or verify the rental and relevant persons through the Rental Registration System.

6.3 Payments, deposits and accounting

We process Personal Data to request and administer payments, Card Authorisations, Pre-authorisations and Security Deposits; issue invoices and receipts; process refunds; collect Charges; administer Fines, Toll Charges and Parking Charges; respond to declined or disputed transactions and chargebacks; prevent payment fraud; maintain accounting and tax records; and enforce payment rights.

6.4 Vehicle administration, safety and security

We process Vehicle Data and other Personal Data to identify, locate and manage the Vehicle; confirm Handover and Return; calculate time, mileage, fuel and charge; protect persons and property; prevent, detect and investigate theft, misappropriation, unauthorised access, tampering, prohibited cross-border movement, Prohibited Use, Material Breach and other security events; and, where permitted, restrict, immobilise or recover the Vehicle.

6.5 Maintenance, assistance and service quality

We process Personal Data to monitor relevant Vehicle condition and warnings; arrange inspection, maintenance, repair, cleaning, roadside assistance, towing, recovery, storage or replacement; investigate technical problems; respond to customer-service requests; and improve the safety, reliability and administration of our services.

6.6 Accidents, claims, insurance and disputes

We process Personal Data to respond to an emergency or Reportable Event; obtain or verify a Police Report; preserve evidence; determine responsibility; assess Damage, Total Loss, Downtime Charges and other loss; notify and cooperate with an insurer; administer CDW or PAI; handle third-party, bodily-injury and property claims; obtain assessments, repairs and recoveries; manage complaints; establish, exercise or defend legal rights; and conduct or respond to judicial, security or enforcement procedures.

6.7 Legal, regulatory and authority requirements

We process Personal Data to comply with Applicable Law, tax and accounting duties, licensing and insurance requirements, lawful orders and requests, RTA and Rental Registration System requirements, police and court procedures, traffic and transport rules, sanctions or other legally required screening, and obligations concerning Fines, Impoundment, public safety and record keeping.

6.8 Fraud prevention, audit and business protection

We process Personal Data to verify transactions and documents; prevent, detect and investigate fraud, forgery, identity misuse, false statements, unauthorised payments, money laundering where applicable, theft and abuse; protect our personnel, customers, Vehicles, systems and business; conduct internal controls and audits; and retain evidence reasonably required for claims or enforcement.

6.9 Website operation, analytics and advertising

We process website and device information to provide requested website functions; maintain security and availability; remember choices; measure visits and performance; understand how users find and use the website; attribute enquiries and bookings; evaluate campaigns; prevent invalid traffic and fraud; and, where permitted and subject to required consent, provide or measure personalised advertising.

6.10 Marketing and relationship management

Where permitted, we process contact details, preferences and interaction history to send news, offers, service updates, invitations or surveys; manage customer relationships; tailor communications; record consent and objections; and ensure that a person who opts out is not contacted through the relevant marketing channel.

6.11 Corporate transactions and professional administration

Personal Data may be processed for confidential due diligence, financing, insurance, audit, restructuring, merger, acquisition, sale of assets or business transfer only to the extent that a lawful ground under section 7 applies. Preliminary information shall be anonymised or aggregated where reasonably practicable, and identifiable information shall be subject to appropriate confidentiality, access restrictions and Applicable Law.

7. LAWFUL GROUNDS FOR PROCESSING

The lawful ground depends on the particular processing. Under the UAE Data Protection Law, we may process Personal Data:

(a) with the Data Subject’s valid consent, including where consent is required for particular marketing, cookies or other optional processing;

(b) where processing is necessary to take steps requested by the Data Subject before entering into a contract or to conclude, amend, perform or terminate a contract to which the Data Subject is a party;

(c) where processing is necessary for the Company to comply with obligations imposed by UAE law;

(d) where processing is necessary to protect the Data Subject’s interests, including in an emergency;

(e) where processing is necessary to protect the public interest;

(f) where processing is necessary to establish, exercise or defend rights or legal claims, or is related to judicial or security procedures;

(g) where processing is necessary for medical diagnosis, healthcare, health insurance or related claims and is carried out subject to the safeguards required by Applicable Law;

(h) where the Personal Data has been made public by the Data Subject, to the extent its use is lawful and compatible with the circumstances in which it was made public; or

(i) on another ground permitted by Applicable Law.

The Company does not rely on a general assertion of its own “legitimate interests” as a substitute for a lawful ground where the UAE Data Protection Law does not recognise that assertion as an independent ground for the processing concerned.

Where processing is based on consent, the Data Subject may withdraw that consent using the contact details in section 21. Withdrawal does not affect processing lawfully carried out before withdrawal and does not stop processing that is required or permitted on another lawful ground. Refusing or withdrawing consent for optional marketing or advertising does not prevent a rental. Refusing information necessary for a Booking, driver verification, payment, registration, insurance or legal compliance may mean that the Company cannot confirm or perform the requested service, approve a driver, complete Handover or administer a claim.

8. VEHICLE DATA, TRACKING AND IMMOBILISATION

Vehicle Data is processed for the purposes described in clause 5.7 of the rental Terms and Conditions and this Privacy Policy. It may be collected, stored or transmitted during the Rental Period and, where reasonably necessary, before Handover and after Return for Vehicle preparation, security, inspection, recovery, maintenance, investigation, claims and record preservation.

The Company may use Vehicle Data together with other reliable information when making an operational or protective decision, including a decision to contact the Renter, require the Vehicle to be stopped or Returned, investigate an event, notify a Competent Authority, or restrict or immobilise the Vehicle in accordance with the Agreement and Applicable Law. The Company does not undertake to monitor a Vehicle continuously or in real time, and monitoring does not create a duty to detect, warn of or prevent an Accident, offence, theft, mechanical problem or other event.

Vehicle Data may be generated or held by the Vehicle, manufacturer, telematics or security provider, insurer, Company or Competent Authority. A Tracking Device installed or operated under the requirements of a Competent Authority may be accessible to that authority independently of the Company. The Company does not control independent authority access or processing.

The location, technical design, access credentials and detailed capabilities of a Tracking Device or Immobilisation Device are security-sensitive and will not be disclosed where disclosure could compromise Vehicle security, fraud prevention, an investigation or the Company’s lawful rights.

9. WHEN WE DISCLOSE PERSONAL DATA

We may disclose Personal Data only to the extent reasonably necessary for a purpose described in this Privacy Policy or otherwise permitted or required by Applicable Law. Recipients may include:

(a) the Renter, an Authorised Driver, Cardholder, Guarantor, corporate customer or authorised representative, but only to the extent relevant to that person’s role and authority;

(b) RTA, the Rental Registration System, police, public prosecution, courts, municipalities, transport and traffic authorities, toll and parking operators, licensing authorities, tax authorities and other Competent Authorities;

(c) insurers, insurance brokers, claims administrators, PAI providers, loss adjusters, assessors, surveyors, investigators, repairers and salvage providers;

(d) banks, acquirers, card networks, card issuers, payment gateways, payment-link providers and providers involved in fraud prevention, identity verification, refunds or chargebacks;

(e) Vehicle owners where the Company is not the owner, manufacturers, authorised dealers, connected-vehicle, telematics, tracking, immobilisation, diagnostic and security providers;

(f) delivery drivers, chauffeur and transfer operators, roadside-assistance, recovery, towing, storage, parking, cleaning, maintenance and repair providers;

(g) website hosting, cloud storage, email, communications, document-management, electronic-signature, customer-service, IT support, cybersecurity, analytics, advertising and social-media providers;

(h) accountants, auditors, lawyers, experts, courts, debt-recovery and enforcement providers, subject to professional duties and Applicable Law;

(i) travel agents, brokers, corporate travel managers, hotels, concierge providers and other intermediaries involved in arranging or performing the requested service; and

(j) a prospective purchaser, investor, lender, insurer or professional adviser in connection with a bona fide corporate transaction, but only to the extent that a lawful ground under section 7 applies and subject to appropriate confidentiality and access controls.

Some recipients act as Processors under contract and may process Personal Data only for authorised purposes. Other recipients, including Competent Authorities, insurers, banks, card networks, card issuers and digital platforms, may act as independent Controllers under their own legal duties and privacy notices.

Vehicle rental is a regulated and security-sensitive activity. The Company may be required or permitted to collect, retain, register, verify, make available or disclose Personal Data and Vehicle Data to a Competent Authority, including through the Rental Registration System or another mandatory government system or connection, in response to a request, direction, inspection, inquiry, investigation, order, warrant or other legal process, or where reporting or cooperation is required or permitted in connection with crime prevention or detection, national security, public safety, road safety, a traffic or licensing matter, an Accident, a missing or stolen Vehicle, unauthorised use, a Fine, Impoundment, insurance, a claim or enforcement of Applicable Law.

Such disclosure may include identity and driving-licence documents; contact, Booking, Agreement, payment and Cardholder records; Vehicle, Handover, Return and access records; Vehicle Data, location, tracking, telematics and immobilisation information; CCTV, photographs, recordings and communications; Accident, offence, insurance, Fine, toll, parking, recovery and Impoundment records; and any other information lawfully required or permitted for the relevant authority purpose. The Company is not required to obtain the Data Subject’s consent where another lawful ground applies.

The Company may disclose information without prior or subsequent notice to the Data Subject where notice is prohibited or restricted by Applicable Law or a Competent Authority, would prejudice an inquiry, investigation, prevention measure, recovery action, national-security or public-safety purpose, or would expose confidential or security-sensitive methods. Where lawful and reasonably practicable, the Company may verify the identity and authority of the requester and keep a record of the disclosure, but it is not required to challenge or delay a lawful request, lawful direction or mandatory system disclosure from a Competent Authority.

In connection with payment verification, a Card Authorisation, Pre-authorisation, Security Deposit, refund, reversal, suspected fraud, card-scheme inquiry, retrieval request, chargeback or other payment dispute, the Company may disclose relevant Personal Data and supporting evidence to an acquiring bank, payment gateway, payment processor, card network, card issuer, Cardholder’s bank, fraud-prevention provider or their authorised representatives. The evidence may include the Booking and Agreement; acceptance records and signatures; identity, driving-licence and Cardholder-authority records; payment and authentication records; correspondence and call records; Handover, Return, delivery, collection and Vehicle-access records; invoices and the calculation of Charges; photographs, video and CCTV; Vehicle Data, location and telematics; and records concerning use, mileage, fuel, charging, damage, an Accident, a Fine, toll, parking, recovery or Impoundment. Disclosure will be limited to what is reasonably necessary or lawfully required for the relevant verification, fraud-prevention, recovery or dispute purpose. The Company is not required to obtain separate consent where the disclosure is necessary to perform or enforce the Agreement, establish, exercise or defend legal rights, comply with Applicable Law, or is otherwise permitted under a lawful ground identified in section 7. Compliance with payment-system procedures does not by itself create a lawful ground for disclosure.

The Company does not sell passport, Emirates ID, driving-licence, payment-card, precise Vehicle-location, health, Accident or claims data for money. Advertising and analytics providers may receive online identifiers and website-use information through cookies or similar technologies as described in section 15; this is controlled separately from operational rental records.

10. INTERNATIONAL TRANSFERS

Some service providers, digital platforms, manufacturers, insurers or professional advisers may store or process Personal Data outside the UAE or permit authorised support access from another country. International transfer may therefore occur, including when a person contacts the Company through an international communications or social-media platform.

Where the UAE Data Protection Law applies to a transfer outside the UAE, the Company will use a transfer mechanism permitted by that law. Depending on the circumstances, this may include transfer to a country recognised as providing an adequate level of protection; contractual safeguards meeting the requirements of Applicable Law; explicit consent where legally valid; a transfer necessary for performance of a contract or steps requested by the Data Subject; a transfer necessary to establish, exercise or defend legal rights; or another permitted exception.

No transfer mechanism removes the recipient’s own obligations under Applicable Law. The Company will take reasonable steps appropriate to the nature of the data and transfer, but cannot alter the legal powers of a foreign court or authority over a recipient operating in that jurisdiction.

11. RETENTION OF PERSONAL DATA

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required or permitted by Applicable Law. The applicable period depends on the category of data, the status of a Booking or Agreement, payment and claim history, authority and insurer requirements, limitation periods, and whether a dispute, investigation or enforcement matter remains open.

The following criteria ordinarily apply:

(a) enquiry and quotation records that do not lead to a Booking are retained for a limited relationship-management and dispute period, then deleted or anonymised unless the person consents to continued marketing or a legal issue requires longer retention;

(b) Booking, Agreement, identity, driver-eligibility, Handover, Return, accounting, payment and tax records are retained for the period required by the Rental Registration System, tax, accounting, licensing and other Applicable Law and, where necessary for contractual, insurance, audit or legal claims, ordinarily for up to seven years after the relevant rental and final settlement, or longer where a mandatory period or active matter requires it;

(c) a copy of a passport, Emirates ID, driving licence, IDP or verification image is not retained merely because it was inspected. Where a copy or electronic record is required for registration, verification, fraud prevention, insurance, payment defence or legal compliance, it is retained only for the applicable operational, legal and claims period;

(d) routine Vehicle Data is retained according to the purpose, system capability, provider settings and applicable authority requirements. Selected Vehicle Data, extracts or reports may be retained with the Agreement or incident file for the longer period applicable to a Reportable Event, Damage, Fine, payment dispute, complaint, investigation or legal claim;

(e) CCTV footage controlled by the Company, where used, is ordinarily retained for a short security period and overwritten, unless it is preserved for a specific incident, investigation, claim or legal requirement;

(f) payment tokens and Card Authorisation records may be retained while amounts may still become due under the Agreement and for the subsequent accounting, chargeback, fraud and claims period permitted by Applicable Law and provider rules;

(g) marketing contact information is retained until consent is withdrawn, an objection is made, the purpose ends or the information becomes inactive, subject to retaining a minimal suppression record to respect an opt-out; and

(h) website security logs, analytics identifiers and advertising information are retained according to the configured settings, purpose and provider terms, subject to consent and Applicable Law. Aggregated or anonymised reports may be retained longer where they no longer identify an individual.

Where Personal Data is no longer required, we delete it, securely destroy it or anonymise it, subject to technical backup cycles and legal preservation requirements. A deletion request does not require deletion of information that must or may lawfully be retained for an Agreement, payment, tax record, Fine, insurance claim, legal right, security procedure, authority requirement or suppression list.

12. DATA ACCURACY AND THE INDIVIDUAL’S RESPONSIBILITIES

We take reasonable steps appropriate to the purpose to keep Personal Data accurate and current. The Renter, Authorised Driver, Cardholder and other person providing information must provide accurate, complete and genuine information and promptly notify the Company of a relevant change, including a change to contact details, driving licence, visa or residence status, payment method, authority or driver eligibility.

The Company may obtain or rely on updated information from the Rental Registration System, a Competent Authority, insurer, bank, card provider or other reliable source where permitted. Correction of a Company record does not require an independent Controller to change its own record; a request concerning an authority, insurer, bank or platform may need to be made directly to that person.

13. SECURITY

We apply technical and organisational measures reasonably appropriate to the nature, volume and sensitivity of the Personal Data and the risks of the processing. These may include access controls based on role and need; authentication and account controls; encryption in transit where appropriate; system, network and endpoint protections; logging and monitoring; backups; physical document and premises controls; confidentiality obligations; staff instruction; supplier due diligence; and procedures for incident response, recovery and secure disposal.

No method of transmission, storage or security can guarantee absolute protection. A person should not send payment-card details, passwords or unnecessary identity documents through an insecure or unofficial channel. The Company will never ask a customer to disclose a banking password, payment-card PIN or one-time authentication code for the customer’s bank account.

If a Personal Data breach occurs, the Company will assess it and notify the UAE Data Office or another authority having jurisdiction and affected Data Subjects where and within the period required by Applicable Law. Notice may be delayed or limited only where required or permitted by Applicable Law or by a lawful direction of a Competent Authority.

14. MARKETING COMMUNICATIONS

We may send marketing by email, SMS, WhatsApp or another electronic channel only where permitted by Applicable Law and any consent required for that channel has been obtained. Service messages concerning an enquiry, Booking, Agreement, Handover, Return, payment, Fine, security matter, claim or other operational issue are not marketing and may still be sent where necessary.

A person may withdraw marketing consent or object to further marketing at any time by using an unsubscribe facility where provided or contacting us under section 21. The request will apply to the relevant person and channel after a reasonable processing period. We may retain a minimal suppression record so that the person is not inadvertently re-added to a marketing list.

Withdrawing marketing consent does not remove a lawfully published review or content supplied for publication where another legal basis applies, but the Company will consider a valid request concerning such content in accordance with Applicable Law.

15. COOKIES AND SIMILAR TECHNOLOGIES

The website uses cookies, pixels, tags, local storage and similar technologies. Some are set by the Company’s website; others are set or read by third-party providers. The technologies used may change as the website and providers change.

15.1 Strictly necessary technologies

These support security, network operation, load balancing, session management, shopping-cart or booking functions, consent records and other functions requested by the user. The website may not operate correctly if they are blocked. WordPress, WooCommerce, hosting and security services may use such technologies.

15.2 Functional technologies

These remember choices such as dates, times, rental locations, language or interface preferences and may support embedded or communications features.

15.3 Analytics and performance technologies

These help measure traffic, page use, errors, performance, referral sources and user journeys. Providers currently used or integrated on the website may include Google Tag Manager, Google Analytics, Cloudflare analytics and Yandex Metrica. Information may include online identifiers, IP and device information, pages viewed, events and approximate location.

15.4 Advertising technologies

These support advertising attribution, audience measurement, campaign performance, frequency control and, where permitted, personalised advertising. Providers currently used or integrated may include Google Ads and Meta technologies, including Meta Pixel.

15.5 Embedded and social technologies

An embedded feature or widget may allow its provider to receive device and interaction information. The website may include or link to services such as X, Facebook, Instagram, Google services, WhatsApp and Telegram. A plain link ordinarily transfers information to the relevant service only after the user selects it; an embedded widget may contact its provider when the page loads.

Non-essential cookies or similar technologies will be used subject to consent where consent is required by Applicable Law. A user may manage available choices through any consent control displayed on the website and through browser or device settings. Blocking a technology may affect site functions. Browser settings do not necessarily control server logs, pixels, mobile identifiers or processing performed independently by a third-party platform.

The Company does not control how an independent provider combines information from the website with information it already holds about a user who is logged in to that provider. Users should review the provider’s own privacy and advertising settings.

Further details, including the technologies in use, their providers, purposes, categories, durations, international transfers and available consent controls, are provided in the Company’s separate Cookie Policy.

16. AUTOMATED PROCESSING AND PROFILING

The Company may use automated rules or system outputs to calculate rental duration and pricing, check completeness, detect duplicate or suspicious transactions, identify security or fraud indicators, measure advertising, prioritise communications or indicate that a manual review is required. The Rental Registration System, insurer, bank, card issuer or payment provider may also make or support decisions using its own systems.

The Company does not intend to make a decision based solely on automated processing that produces legal effects or similarly seriously affects an individual unless the decision is permitted by Applicable Law and required safeguards are provided. A system rejection, risk indicator or Vehicle alert may be reviewed together with documents, authority results and other available information. A person may request human review of a qualifying Company decision using section 21, subject to exceptions under Applicable Law. The Company cannot review or reverse an independent decision of a Competent Authority, insurer, bank, card issuer or payment provider.

17. CHILDREN AND OTHER MINORS

The website and the Company’s services are not directed to children. The Company does not knowingly collect Personal Data directly from a child or use a child’s Personal Data for marketing. A minor cannot be approved as an Authorised Driver. If information relating to a minor is received incidentally in connection with an Accident, insurance claim, police, court or authority requirement or legal claim, it will be processed only to the extent required or permitted by Applicable Law.

18. THIRD-PARTY WEBSITES, PLATFORMS AND COMMUNICATION CHANNELS

Links to another website, map, social network, review site, payment page or messaging service do not make the Company responsible for that provider’s privacy practices. If a person chooses to communicate through WhatsApp, Telegram, a social-media platform or another third-party channel, the provider may process message, account, contact, device and usage information under its own terms, potentially outside the UAE.

The Company may preserve a business communication received through such a channel as part of the Booking, Agreement, service or dispute record. Deleting a message from the user’s device or platform account does not necessarily delete the Company’s lawfully retained business record or the provider’s copy.

19. DATA SUBJECT RIGHTS

Subject to the conditions, exceptions and procedures in Applicable Law, a Data Subject may have the right to:

(a) obtain information about the Personal Data processed by the Company, the purposes, categories, recipients, safeguards, retention criteria, source and qualifying automated processing;

(b) request access to or a copy of Personal Data;

(c) request correction, completion or updating of inaccurate Personal Data;

(d) request erasure of Personal Data where the legal conditions are met;

(e) request restriction or cessation of processing in the circumstances provided by law;

(f) object to direct marketing and to other processing where a right of objection applies;

(g) withdraw consent where processing is based on consent;

(h) request transfer of Personal Data supplied to the Company in a structured and machine-readable format where the right to portability applies;

(i) object to or request review of a qualifying decision based solely on automated processing; and

(j) complain to the competent supervisory authority, including the UAE Data Office where it has jurisdiction.

These rights are not absolute. The Company may refuse, limit or defer a request where permitted or required by Applicable Law, including where necessary to protect another person’s rights, preserve evidence, comply with a legal obligation or authority restriction, complete an active claim or security procedure, or establish, exercise or defend legal rights.

20. HOW TO MAKE A PRIVACY REQUEST

A request may be sent using the contact details in section 21 with the subject line “Privacy Request”. It should state the requester’s name, contact details, relationship with the Company, relevant Booking or Agreement number if applicable, the right being exercised and enough detail to identify the relevant records.

Before acting, the Company may take reasonable steps to verify identity and authority. Verification may require information matching existing records or production of an identity document. The Company will not retain a new copy of an identity document for verification longer than necessary unless Applicable Law requires otherwise. An authorised representative may be required to provide proof of authority and identity.

The Company will respond within the period required by Applicable Law. A request may be refused, limited or deferred only where permitted or required by Applicable Law, and the Company will provide any explanation or notice required by that law.

Providing access does not require disclosure of another person’s Personal Data, legally privileged material, security-sensitive tracking or anti-fraud information, confidential commercial information, or information that the Company is prohibited from disclosing. Where practicable, the Company may redact protected information and provide the remainder.

21. CONTACT DETAILS

Privacy questions and requests concerning processing by the Company may be directed to:

Imperial Premium Rent a Car LLC

Privacy contact

Address: P.O. Box 236833, Dubai, UAE

Email: [email protected]

Website: www.imperial-rac.com

The subject line “Privacy Request” should be used for rights requests. The privacy contact is an operational contact and is not described as a statutory Data Protection Officer unless the Company separately appoints and identifies that person as such.

22. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in law, regulatory requirements, services, technology, Vehicles, systems or processing practices. The current version will be published on the Company’s website with its effective date.

A change to this Privacy Policy does not retrospectively create consent, expand a contractual right or make previously unlawful processing lawful. Where a change materially affects processing and Applicable Law requires notice or consent, the Company will provide the required notice or obtain the required consent through an appropriate channel.

The version applicable to processing at a particular time may be preserved in the Company’s records. A person should review the current version when making a new Booking or providing new Personal Data.