Privacy Policy

Legal entity responsible for customer data privacy

• The data controller for personal data collected via this portal is Dunes Discovery Tourism L.L.C, Trade License 1430583, Dubai, UAE.
• Data Protection Officer Contact: privacy@dunesdiscoverytourism.com or info@dunesdiscoverytourism.com.
• Telephone and WhatsApp Data Desk: +971 50 245 6056 (Customer Privacy & Data Rights Desk).
• This policy applies to all customer data collected online through https://dunesdiscoverytourism.com, WhatsApp booking channels, and field operations.

Explanation of terms used in this Privacy Policy

Personal identification, booking details, logistics and technical telemetrics

• Personal Identification: Full passenger name, title, preferred language, and nationality.
• Contact Details: Primary email address, mobile telephone number, and WhatsApp chat handle.
• Logistics & Booking Preferences: Hotel name, room number, pickup address, party size, dietary requirements, and tour dates.
• Opt-in Precise Geolocation: With explicit user consent, browser GPS coordinates (latitude, longitude, horizontal accuracy) to resolve pickup addresses.
• Financial Transaction Records: Payment transaction identifiers, payment method (card, Apple Pay, cash), and amount paid in AED. (Note: Credit card numbers are never stored locally).
• Technical & Analytics Telemetry: IP address, device model, browser user-agent, operating system, UTM marketing source tags, and session timestamps.

Types of personal data collected from users

Contractual necessity, legal compliance, legitimate interest and consent

• Contractual Performance: Processing is indispensable to process booking requests, issue travel vouchers, dispatch chauffeurs, and fulfill excursion contracts.
• Legal Obligation: Retaining transactional invoices for UAE Federal Tax Authority (FTA) auditing and furnishing passenger lists to Dubai DET when mandated.
• Legitimate Interests: Defending our platform against fraudulent card transactions, managing server workloads, and optimizing tour package offerings.
• Explicit Consent: Sending opt-in promotional WhatsApp offers, collecting exact browser GPS telemetrics, and setting optional marketing tracking cookies.

Why personal data is processed

Payment processors, analytics engines, advertising networks and cloud hosts

• Ziina Payment Gateway: Licensed by the Central Bank of the UAE and certified PCI-DSS Level 1 for secure card tokenization and Apple Pay / Google Pay processing.
• Google LLC: Google Analytics 4 (GA4), Google Tag Manager (GTM), Google Ads Conversion Tracking (AW-17859624049), and reCAPTCHA Enterprise bot defense.
• Meta Platforms Inc: Meta Pixel and Meta Conversions API (CAPI) for privacy-conscious server-side advertising attribution and audience measurement.
• OpenStreetMap Nominatim: Used for client-side reverse geocoding to resolve street names from coordinates without storing persistent user identifiers.
• Emergency Transport & Rescue: Disclosing emergency contact details and pickup locations to Dubai Police, Dubai Ambulance, or civil defence during rescue operations.

Legal grounds under UAE law, GDPR, and international standards

TLS 1.3 encryption, AES-256 database protection and cross-border safeguards

• Encryption in Transit: All communications between your browser and our servers are encrypted using high-grade Transport Layer Security (TLS 1.3).
• Encryption at Rest: Sensitive database records, authentication tokens, and booking archives are stored with AES-256 cryptographic encryption.
• Restricted Access: Internal access to customer booking records is strictly restricted to licensed dispatch personnel and authenticated administrators.
• Cross-Border Compliance: Any transfer of customer data outside the UAE complies with Chapter 5 of the UAE PDPL and European Standard Contractual Clauses.

Who we share data with

Statutory tax archiving, booking history and automated data purging

• Completed Booking Records: Retained for 5 calendar years to satisfy commercial accounting and UAE Federal Tax Authority VAT audit mandates.
• Customer Inquiries & WhatsApp Leads: Retained for up to 24 months from the last interaction to assist recurring guests, after which records are depersonalized.
• Ephemeral Verification Codes: Email OTP codes and temporary draft tokens are automatically purged within 24 hours of generation.
• Server Web Access Logs: Retained for 90 days for cybersecurity analysis, DDoS mitigation, and intrusion detection auditing.

How long data is stored and deletion

Access, rectification, erasure, restriction and data portability rights

• Right to Access: You may request confirmation of whether we process your data and receive a readable copy of your booking history.
• Right to Rectification: You may request correction of inaccurate contact numbers, passenger spellings, or hotel pickup information.
• Right to Erasure: You have the right to request deletion of your personal data where retention is no longer mandated by UAE tax and accounting laws.
• Right to Withdraw Consent: You may revoke marketing or GPS tracking consent at any time without affecting the lawfulness of prior processing.
• Submitting a Data Rights Request: Send an email with verified proof of identity to privacy@dunesdiscoverytourism.com. Requests are handled within 30 days.

Website tracking and cookies

Rights of users regarding their data

How personal data is protected

Policy regarding data from children

Transferring data outside UAE

User consent and opt-out

Updates and revisions to the policy

Applicable laws and courts

Company contact details for data inquiries