← Back

// CityCar · RentOS · DealerOS

Privacy Policy

Effective Date: May 2026 | Version 2.0

Citycar Rental Dubai LLC | citycar.ae | rentos.ae | dealeros.ae

1. Introduction & Controller Information

This Privacy Policy describes how Citycar Rental Dubai LLC ("we", "us", "our") collects, uses, stores, and protects your personal data when you use any of our platforms: CityCar (citycar.ae), RentOS (rentos.ae), DealerOS (dealeros.ae), and associated mobile applications.

Data Controller:
Citycar Rental Dubai LLC
Director: Hamid Arbatsofla
Trade License No: 1023095, Dubai Department of Economy and Tourism
Email: info@citycar.ae | Phone: +971 58 575 1800 | Office: +971 4 572 8558

This Policy is governed by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and Cabinet Resolution No. 33 of 2024. We are committed to full compliance with these laws.

2. Data We Collect

2.1 Data You Provide Directly

  • Identity data: full name, date of birth, nationality
  • Contact data: email address, phone number, WhatsApp number
  • Identity documents: Emirates ID, passport, driving licence (for verification purposes)
  • Account data: username, password (encrypted), account preferences
  • Business data (RentOS/DealerOS tenants): company name, trade licence number, fleet details, customer records
  • Payment data: billing address, payment method details (processed by Stripe — not stored by us)
  • Communications: messages, support requests, feedback

2.2 Data Collected Automatically

  • Device data: IP address, browser type, operating system, device identifiers
  • Usage data: pages visited, features used, session duration, clicks
  • Location data: approximate location (for service delivery and pricing)
  • Cookies and tracking: session cookies, analytics cookies, preference cookies

2.3 Data from Third Parties

  • Payment processors (Stripe): transaction confirmation and payment status
  • Apple App Store / Google Play Store: app download and usage data
  • Analytics providers: aggregated usage patterns

3. How We Use Your Data

3.1 Contract Performance

  • Processing car rental bookings on CityCar
  • Providing RentOS/DealerOS subscription services to tenants
  • Managing Partner Program commission payments
  • Processing payments and issuing VAT-compliant invoices

3.2 Legal Compliance

  • Complying with UAE VAT Law (Federal Decree-Law No. 8 of 2017)
  • Complying with UAE Anti-Money Laundering regulations
  • Responding to lawful requests from UAE government authorities
  • Maintaining records as required by UAE Commercial Companies Law

3.3 Legitimate Business Interests

  • Improving and developing our platforms
  • Preventing fraud and ensuring platform security
  • Sending service-related communications
  • Analyzing usage patterns to enhance user experience

3.4 With Your Consent

  • Sending marketing communications about new features and offers
  • Sharing your data with selected third-party partners
  • Processing sensitive personal data categories

4. Data Sharing & Third Parties

We do not sell your personal data. We share your data only with:

  • Service providers: Stripe (payments), Supabase (database), Anthropic (AI services), Resend (email), Apple/Google (mobile apps) — all under data processing agreements
  • Car rental operators: booking details shared with the operator fulfilling your CityCar booking
  • Legal authorities: when required by UAE law or court order
  • Business transfers: in the event of merger, acquisition, or asset sale, with notice to users

All third-party service providers are required to handle your data in accordance with applicable data protection laws and our instructions.

5. Data Retention

  • Account data: retained for the duration of your account plus 5 years
  • Transaction records: retained for 10 years (UAE VAT compliance requirement)
  • Support communications: retained for 3 years
  • Marketing preferences: retained until you withdraw consent
  • Anonymized analytics data: retained indefinitely

Upon account deletion or termination of subscription, personal data is deleted within 30 days, except where retention is required by law.

6. Cookies Policy

  • Essential cookies: required for the Platform to function (cannot be disabled)
  • Analytics cookies: help us understand how users interact with our Platform (Google Analytics)
  • Preference cookies: remember your settings and preferences
  • Marketing cookies: used to display relevant content (only with consent)

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

7. Your Rights Under UAE PDPL

As a data subject under UAE Federal Decree-Law No. 45 of 2021, you have the following rights:

  • Right to Access: request a copy of your personal data we hold
  • Right to Rectification: correct inaccurate or incomplete data
  • Right to Erasure: request deletion of your data (subject to legal retention requirements)
  • Right to Restriction: limit how we process your data
  • Right to Portability: receive your data in a structured, machine-readable format
  • Right to Object: object to processing based on legitimate interests
  • Right to Withdraw Consent: withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at info@citycar.ae. We will respond within 30 days. You may also lodge a complaint with the UAE Data Office.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encryption of data in transit (TLS 1.3) and at rest (AES-256)
  • Row-level security on our database infrastructure (Supabase)
  • Access controls and multi-factor authentication for platform administration
  • Regular security assessments and penetration testing
  • Employee training on data protection obligations

In the event of a data breach that affects your rights and freedoms, we will notify you and the UAE Data Office within 72 hours of becoming aware of the breach, in accordance with UAE PDPL requirements.

9. International Data Transfers

Your data may be processed by our service providers in countries outside the UAE. Where this occurs, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses with service providers
  • Transfers only to countries with adequate data protection frameworks
  • Data Processing Agreements with all third-party processors

10. Children's Privacy

Our platforms are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact info@citycar.ae and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Email notification to your registered email address
  • Prominent notice on our Platform
  • In-app notification

The updated Policy will be effective 30 days after notification. Continued use of the Platform constitutes acceptance of the updated Policy.

12. Contact & Complaints

Data Protection Officer / Privacy Inquiries:

Citycar Rental Dubai LLC
Attention: Data Protection — Hamid Arbatsofla
Tamani Arts Building, Business Bay, Dubai, UAE
Email: info@citycar.ae
Phone: +971 58 575 1800
Office: +971 4 572 8558
WhatsApp: wa.me/971585751800

UAE Data Office (for regulatory complaints): uaedataoffice.ae