Menu
Close

PRIVACY POLICY

How CarEjar Collects, Uses, Stores and Protects Your Personal Data

YOUR PRIVACY AT A GLANCE — KEY FACTS

WHO WE ARE: CarEjar Portal L.L.C S.O.C (Trade License No. 1593740), Dubai, UAE — a digital car rental marketplace.

WHAT WE COLLECT: Your name, contact details, driving licence, Emirates ID/passport, payment details (tokenised), location data, and how you use our Platform.

WHY WE COLLECT IT: To process your bookings, handle payments (including post-rental charges), verify your identity, prevent fraud, and keep the Platform secure.

WHO WE SHARE IT WITH: Rental Agencies (for your booking only), Stripe (payment processing), analytics and support providers, and UAE government authorities when required by law. We do NOT sell your data.

HOW LONG WE KEEP IT: Booking data for 5 years (UAE commercial law). Payment records for 5 years (UAE VAT law). Identity/KYC data for 5 years (UAE AML law).

YOUR RIGHTS: Access, correct, delete, restrict, object, and portability rights under UAE Federal Decree-Law No. 45 of 2021 (PDPL). Contact: dpo@carejar.net.

COOKIES: We use cookies on our website and app. See our separate Cookie Policy at www.carejar.net/legal/cookie-policy.

SECTION 1: WHO WE ARE — DATA CONTROLLER IDENTITY

CarEjar Portal L.L.C S.O.C (‘CarEjar’, ‘we’, ‘us’, ‘our’) is a one-person limited liability company incorporated in the Emirate of Dubai, United Arab Emirates, bearing Trade License Number 1593740 issued by the Department of Economy and Tourism (DET). CarEjar operates the CarEjar digital car rental marketplace Platform — a website (www.carejar.net) and mobile applications (iOS and Android) — through which users can discover, compare, and book rental vehicles from independent, licensed rental agencies.

CarEjar is the Data Controller for all personal data collected, processed, and stored through the Platform, as defined under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (‘UAE PDPL’).

Contact

Details

Company:

CarEjar Portal L.L.C S.O.C

Trade License No.:

1593740 — Dubai, UAE

Registered Address:

P.O. Box 45195, Dubai, UAE

General Support:

info@carejar.net

Data Protection Officer:

info@carejar.net

Website:

www.carejar.net

Our Data Protection Officer (DPO) is responsible for overseeing CarEjar’s compliance with UAE PDPL and this Privacy Policy. You may contact the DPO at any time at info@carejar.net for any privacy-related matter. We will respond within 30 calendar days.

SECTION 2: WHAT PERSONAL DATA WE COLLECT AND WHY

We collect personal data from you in different ways and for different purposes. This Section explains every category of personal data we collect, why we collect it, the legal basis for doing so under UAE PDPL, and how long we keep it.

2.1 Identity and Verification Data

What we collect:

  • Full legal name (as on government-issued ID);
  • Date of birth and nationality;
  • Passport number or UAE Emirates ID number;
  • Driving licence number, issuing country/emirate, expiry date, and licence category;
  • Selfie photograph submitted during KYC verification (where required);
  • Business name and trade licence number (for Agency accounts).

Why we collect it: To verify your identity before you can make bookings, to comply with UAE Anti-Money Laundering obligations (Federal Decree-Law No. 20 of 2018), to confirm you hold a valid driving licence, and to prevent fraud and account misuse.

Legal basis: Article 5(b) UAE PDPL — performance of contract; Article 5(c) — compliance with legal obligation (UAE AML/KYC).

Retention: 5 years from account closure or last transaction, whichever is later — required by UAE AML law.

2.2 Contact and Account Data

What we collect:

  • Email address;
  • Mobile telephone number;
  • Residential or business address (including emirate, city, and country);
  • Account username and encrypted password hash;
  • Profile preferences and notification settings.

Why we collect it: To create and manage your account, send booking confirmations, communicate with you about your rentals, send service notifications, and respond to support requests.

Legal basis: Article 5(b) UAE PDPL — performance of contract.

Retention: Duration of account plus 2 years after account closure. Email address retained for 5 years for legal compliance purposes.

2.3 Booking and Transaction Data

What we collect:

  • Booking reference numbers and booking history;
  • Vehicle details booked (make, model, registration plate, rental period);
  • Pick-up and drop-off locations and times;
  • Booking status, cancellation records, and modification history;
  • Rental Agreement terms accepted;
  • Pre-rental and post-rental inspection records and photographs;
  • Post-rental charges incurred (traffic fines, Salik/Darbi tolls, vehicle damage, fuel, cleaning);
  • Dispute and complaint records.

Why we collect it: To process your bookings, facilitate the Rental Agreement between you and the Agency, manage escrow and payment flows, process post-rental charges, and resolve disputes.

Legal basis: Article 5(b) UAE PDPL — performance of contract.

Retention: 5 years from the Booking date — required by UAE Commercial Transactions Law (Federal Law No. 18 of 1993) for commercial record-keeping.

2.4 Payment Data

What we collect:

  • Payment method type (credit card, debit card, Apple Pay, Google Pay);
  • Stripe Merchant Token / MPAN (Network Token) — a tokenised representation of your card stored by Stripe. We do NOT store your full card number, CVV, or physical card details;
  • Billing address associated with your payment method;
  • Transaction history (amounts charged, dates, charge types, successful/failed status);
  • Stripe payment session identifiers and gateway reference numbers;
  • Bank chargeback records (where applicable).

Why we collect it: To process booking payments, pre-authorise security deposits, initiate Merchant-Initiated Transactions (MIT) for post-rental charges within the 90-day window, issue invoices and receipts, and defend against unjustified chargebacks.

Legal basis: Article 5(b) UAE PDPL — performance of contract; Article 5(e) — legitimate interest (fraud prevention and chargeback defence).

Retention: 5 years from last transaction — required by UAE VAT Law (Federal Decree-Law No. 8 of 2017) for tax invoice records.

Note on Stripe: Your payment credentials are processed and stored by Stripe in compliance with PCI-DSS standards. Stripe’s Privacy Policy is available at stripe.com/gb/privacy. CarEjar holds only the tokenised reference, not your raw card data.

2.5 Location Data

What we collect:

  • Pick-up and drop-off location coordinates as entered during booking;
  • Real-time GPS location (mobile app only) — only when you actively use the map or navigation features and only with your explicit permission via your device’s location settings;
  • Approximate location inferred from your IP address (used to suggest nearby vehicles and set default search location).

Why we collect it: To show you available vehicles near your location, to facilitate pick-up and drop-off coordination, and to improve location-based search results.

Legal basis: Article 4 UAE PDPL — your consent (for precise real-time GPS); Article 5(b) — performance of contract (for booking-related location data).

Retention: Real-time GPS data is not stored beyond the active session. Pick-up/drop-off coordinates are retained as part of the Booking record (5 years). IP-inferred location is session-only.

How to withdraw GPS consent: Disable location permissions for the CarEjar app in your device settings (iOS: Settings → Privacy → Location Services → CarEjar; Android: Settings → Apps → CarEjar → Permissions → Location).

2.6 Device and Technical Data

What we collect:

  • IP address;
  • Device type, model, and operating system version;
  • Browser type and version;
  • App version;
  • Session identifiers and authentication tokens;
  • Crash reports and error logs (anonymised where possible);
  • Time zone and language settings.

Why we collect it: To maintain Platform security, authenticate your sessions, diagnose technical issues, prevent fraud, and comply with cybersecurity obligations under UAE Federal Decree-Law No. 34 of 2021 (Cybercrimes Law).

Legal basis: Article 5(e) UAE PDPL — legitimate interest (platform security and fraud prevention).

Retention: Session data: 90 days. Security logs: 12 months. Crash/error logs: 6 months.

2.7 Usage and Behavioural Data

What we collect:

  • Pages visited and features used on the Platform;
  • Search queries entered (vehicle type, location, dates);
  • Listings viewed and time spent on each;
  • Booking funnel drop-off points;
  • In-app actions (filters applied, saved vehicles, reviews submitted).

Why we collect it: To understand how the Platform is used, to identify and fix usability issues, to improve search and recommendation algorithms, and to develop new features.

Legal basis: Article 4 UAE PDPL — your consent (via Cookie Preference Centre); Article 5(e) — legitimate interest (platform improvement) where data is fully anonymised and aggregated.

Retention: Aggregated analytics data: indefinitely (no personal data). Individual usage logs: 12 months.

2.8 Communications Data

What we collect:

  • Messages sent through CarEjar’s in-app messaging or support chat;
  • Email correspondence with CarEjar’s support, disputes, or legal teams;
  • Feedback, reviews, and ratings submitted on the Platform;
  • Dispute submissions and supporting evidence;
  • Voice note or call recordings where support calls are recorded (you will be notified at the start of any recorded call).

Why we collect it: To respond to your queries, resolve disputes, improve our service, and maintain records of commitments and agreements made during support interactions.

Legal basis: Article 5(b) UAE PDPL — performance of contract; Article 5(e) — legitimate interest (quality assurance and dispute resolution).

Retention: Support communications: 3 years. Dispute records: 5 years from resolution. Reviews: for the lifetime of your account.

2.9 Special Categories of Data — Sensitive Information

CarEjar does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) except where strictly required. The limited exceptions are:

  • Driving licence data (which may reveal disability-related endorsements): collected only for legal eligibility verification purposes.
  • Government ID photographs submitted during KYC: processed only for identity verification and immediately stored in encrypted form. We do not use facial recognition technology.
  • If you voluntarily disclose health information (e.g. to explain a cancellation), we will process it only for the purpose for which you disclosed it and will not share it further without your explicit consent.

Legal basis for any sensitive data processing: Article 6 UAE PDPL — explicit consent; or Article 7 — legal obligation.

SECTION 2A: FACE DATA AND SELFIE VERIFICATION — COMPLETE DISCLOSURE

APPLE APP STORE GUIDELINE 5.1.1(I) COMPLIANCE — FACE DATA DISCLOSURE

This section constitutes CarEjar’s complete and explicit disclosure of all face data collection, use, storage, sharing, and retention practices, as required by Apple App Store Review Guideline 5.1.1(i) — Legal — Privacy — Data Collection and Storage.

CarEjar collects a selfie photograph from users during registration. This section explains exactly what is collected, why, where it is stored, who can see it, and how long it is kept.

CarEjar does NOT use facial recognition technology, biometric matching algorithms, or any automated face scanning. All identity verification decisions are made by human review.

2A.1  What Face Data CarEjar Collects

During the registration process, CarEjar requires every User to submit a live selfie photograph (a front-facing photograph of the User’s face) taken directly through the CarEjar mobile application camera. This selfie photograph constitutes the face data collected by CarEjar.

CarEjar does NOT collect:

  • Facial recognition data, facial geometry measurements, or biometric facial templates;
  • Facial scans or 3D face models;
  • Any automated algorithmic analysis of facial features; or
  • Any face data beyond the single selfie photograph described above.

2A.2  Why CarEjar Collects Face Data — Complete Explanation of All Uses

CarEjar collects the selfie photograph for the following purposes only. No other use of face data is made:

2A.2.1   IDENTITY VERIFICATION (KYC): The selfie is used to verify that the person registering on the Platform is the same person whose photograph appears on their government-issued driving licence or passport submitted during registration. This verification is conducted internally by CarEjar staff. CarEjar does not use automated facial recognition — a human reviewer compares the selfie against the ID document photograph.

2A.2.2   FRAUD PREVENTION: The selfie is retained on the User’s profile to assist in detecting and preventing fraudulent account registrations, account takeovers, and impersonation attempts. If suspicious account activity is detected, CarEjar’s security team may compare the selfie on file against any new identity documents or selfies submitted in connection with a suspected fraud investigation.

2A.2.3   IN-PERSON IDENTITY MATCHING AT VEHICLE HANDOVER: When a User makes a booking and arrives to collect the rented vehicle, the selfie photograph is displayed to the Rental Agency’s representative through CarEjar’s dedicated Agency application (B2B platform). This allows the Agency representative to visually match the physical person standing in front of them against the profile photograph and driving licence on file before handing over the vehicle keys. This use is a core safety and anti-fraud feature of the Platform.

2A.2.4   USER PROFILE DISPLAY: The selfie is saved and displayed within the User’s own personal profile in the CarEjar customer application. The User can view their own profile photograph at any time in the app.

CarEjar does NOT use face data for: advertising or marketing targeting; sale to third parties; training of artificial intelligence or machine learning models; profiling for any commercial purpose; or any purpose beyond those listed in Clauses 2A.2.1 to 2A.2.4 above.

2A.3  Where Face Data is Stored and Infrastructure

2A.3.1   STORAGE LOCATION: All face data (selfie photographs) collected by CarEjar are stored on CarEjar’s backend server infrastructure hosted on Google Cloud Platform. CarEjar’s backend servers are the primary data store for all face data. Google Cloud infrastructure is used exclusively for server hosting, data storage, and content delivery services.

2A.3.2   GOOGLE CLOUD’S ROLE — DATA PROCESSOR ONLY: Google Cloud acts solely as a cloud infrastructure and hosting provider (Data Processor) for CarEjar’s face data storage. Google Cloud does not: perform identity verification; make any decisions based on face data; conduct facial recognition or biometric processing; or access face data for any purpose other than providing the contracted hosting infrastructure to CarEjar. Google Cloud’s role is limited to providing encrypted storage and server infrastructure. Google Cloud’s Privacy Policy is available at: cloud.google.com/privacy.

2A.3.3   NO OTHER THIRD PARTIES: CarEjar does not use any third-party KYC verification service, facial recognition API, or biometric data processor. All identity verification decisions are made internally by CarEjar’s own staff. No other third party receives, processes, stores, or has access to Users’ face data.

2A.3.4   SECURITY MEASURES: All face data stored on Google Cloud infrastructure is protected by AES-256 encryption at rest and TLS 1.2+ encryption in transit. Access to face data is restricted to authorised CarEjar staff and, at the point of vehicle handover, to the specific Agency representative processing the relevant Booking. Access is controlled by role-based permissions and multi-factor authentication.

2A.4  Who Can See the Selfie — Visibility Within the Platform

The selfie photograph is visible in the following contexts within the CarEjar ecosystem:

2A.4.1   USER’S OWN PROFILE (Customer App): The selfie is displayed within the User’s own personal profile in the CarEjar customer application (iOS and Android). Only the User themselves can see their own profile photograph in the customer app.

2A.4.2   RENTAL AGENCY STAFF AT VEHICLE HANDOVER (Agency App): When a User arrives to collect a booked vehicle, the User’s selfie photograph is displayed to the Rental Agency’s representative within CarEjar’s dedicated Agency application (the B2B platform used by licensed Rental Agencies). This display occurs only at the specific moment of vehicle handover for the specific Booking. The Agency representative uses the displayed selfie solely to visually confirm that the person collecting the vehicle matches the registered User’s identity on file. Agency staff are bound by CarEjar’s Agency Agreement and Agency T&C to use this data only for this purpose and to treat it as confidential.

2A.4.3   CAREJAR INTERNAL STAFF: Authorised CarEjar staff involved in identity verification, fraud investigation, or dispute resolution may access a User’s selfie photograph in the performance of their duties, subject to role-based access controls.

2A.4.4   NO OTHER VISIBILITY: The selfie is not publicly visible, not shared on any social feed, not displayed to other Users, not transmitted to any external system, and not accessible to any person or system beyond those described in Clauses 2A.4.1 to 2A.4.3.

2A.5  How Long Face Data is Retained — Retention Period and Justification

FACE DATA RETENTION — SPECIFIC PERIOD AND LEGAL JUSTIFICATION

CarEjar retains selfie photographs (face data) for a maximum period of FIVE (5) YEARS from the date of account closure or last booking transaction, whichever is later.

JUSTIFICATION FOR THIS SPECIFIC RETENTION PERIOD:

1. UAE Anti-Money Laundering Law (Federal Decree-Law No. 20 of 2018, Article 23): Requires CarEjar to retain KYC records, including identity verification documents and photographs, for a minimum of 5 years from the end of the business relationship (account closure).

2. Fraud Prevention and Legal Proceedings: UAE limitation periods for civil fraud claims under UAE Federal Law are up to 5 years. CarEjar retains face data for this period to enable identity verification in the event of a fraud investigation or legal proceedings arising from a Booking.

3. UAE Central Bank Consumer Protection Regulations: Require financial services and payment facilitators to maintain identity records for 5 years.

FACE DATA IS NOT STORED INDEFINITELY. Upon expiry of the 5-year retention period, all selfie photographs and associated face data are permanently and irreversibly deleted from CarEjar’s servers and Google Cloud infrastructure.

Google Cloud, as CarEjar’s hosting provider, retains data only for as long as CarEjar’s servers direct. Google Cloud does not maintain any independent retention of CarEjar face data beyond CarEjar’s own retention period.

2A.6  Legal Basis for Face Data Processing

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), CarEjar processes face data on the following legal bases:

  • Article 4 (Explicit Consent): The User’s explicit consent is obtained during registration before the selfie is collected. The User is informed of all uses of the selfie (as described in Section 2A.2) before providing consent. Consent is freely given, specific, informed, and unambiguous.
  • Article 5(c) (Legal Obligation): Retention for 5 years is required by UAE AML Law (Federal Decree-Law No. 20 of 2018).
  • Article 5(b) (Contract Performance): Display of the selfie to the Agency representative at vehicle handover (Clause 2A.4.2) is necessary for the performance of the Booking contract and the physical verification of the User’s identity.

2A.7  Your Rights Regarding Face Data

You have the following specific rights regarding your selfie/face data, exercisable at any time by contacting dpo@carejar.net:

  • Right to Access: Request a copy of the selfie photograph CarEjar holds for your account.
  • Right to Rectification: Request replacement of your selfie photograph if it is outdated or does not clearly represent you subject to re-verification.
  • Right to Erasure: Request deletion of your selfie photograph. Note: where deletion is requested before the 5-year retention period ends, CarEjar may retain the data where required by UAE AML Law. Where deletion is legally permissible, it will be completed within 30 days.
  • Right to Withdraw Consent: You may withdraw consent to face data collection at any time. Withdrawal will prevent future bookings, as identity verification is a mandatory prerequisite for all CarEjar Bookings. Withdrawal does not affect data already processed.

To exercise any of these rights: email dpo@carejar.net with the subject line ‘Face Data Rights Request’ and your registered account email address. We will respond within 30 calendar days.

2A.8  Apple App Store — Specific Responses to Guideline 5.1.1(i) Questions

In direct response to Apple’s App Store Review Guideline 5.1.1(i) requirements, CarEjar provides the following explicit answers:

Q1.    What face data does the app collect? CarEjar collects a single live selfie photograph per User, taken during registration through the in-app camera. No biometric templates, facial geometry data, or facial recognition data is generated or collected.

Q2.    What are all planned uses of the face data? (a) Internal KYC identity verification by CarEjar staff; (b) fraud prevention and security monitoring; (c) display to the specific Rental Agency representative at the moment of vehicle handover for physical identity matching; and (d) display on the User’s own profile within the customer app. No other uses.

Q3.    Will face data be shared with any third parties? Where is it stored? The selfie is stored on Google Cloud infrastructure (CarEjar’s hosting provider — Data Processor only). Google Cloud does not process, analyse, or make decisions based on the face data. No other third party receives face data. At vehicle handover, the selfie is displayed to the Rental Agency’s representative through CarEjar’s Agency app — this is an authorised display within the CarEjar platform ecosystem, governed by data processing agreements binding the Agency.

Q4.    How long will face data be retained? Five (5) years from account closure or last transaction, as required by UAE Anti-Money Laundering Law (Federal Decree-Law No. 20 of 2018). Face data is NOT stored indefinitely. It is permanently deleted upon expiry of the 5-year period.

Q5.    Where in the privacy policy is face data explained? This entire Section 2A (Face Data and Selfie Verification — Complete Disclosure) constitutes the dedicated face data disclosure. Additional references appear in Section 2.9 (Special Categories of Data) and Section 8 (Security Measures).

Q6.    Quoted text from privacy policy concerning face data: See Section 2A.2 (complete uses), Section 2A.3 (storage and Google Cloud’s role), Section 2A.4 (visibility), Section 2A.5 (retention period and justification box), and Section 2A.7 (user rights).

SECTION 3: HOW WE USE YOUR PERSONAL DATA — PURPOSES

We use your personal data only for the purposes for which it was collected, as set out in this Section. We do not use your data for any purpose that is incompatible with those listed below.

Purpose of Processing

Legal Basis (UAE PDPL) and Detail

Account registration and management

Article 5(b) — Contract. Creating your account, verifying your eligibility, maintaining your profile.

Processing bookings and Rental Agreements

Article 5(b) — Contract. Confirming vehicle availability, generating booking references, facilitating the Rental Agreement between you and the Agency.

Payment processing and escrow management

Article 5(b) — Contract. Authorising and capturing payments, holding funds in escrow, releasing payouts to Agencies, processing refunds.

Merchant-Initiated Transaction (MIT) post-rental charges

Article 5(b) — Contract (MIT mandate accepted at booking). Charging stored payment credentials for post-rental charges (fines, tolls, damage, fuel) within 90 days of vehicle return per Platform T&C v1.1 Schedule 1.

Identity verification (KYC)

Article 5(c) — Legal obligation. UAE AML/KYC compliance under Federal Decree-Law No. 20 of 2018.

Fraud prevention and platform security

Article 5(e) — Legitimate interest. Detecting, preventing, and investigating fraudulent transactions, account takeovers, and Platform abuse.

Chargeback defence

Article 5(e) — Legitimate interest. Retaining booking and payment records to respond to unjustified bank chargebacks with documented evidence of the User’s prior MIT authorisation.

Dispute resolution

Article 5(b) — Contract. Managing and resolving disputes between Users and Agencies via CarEjar’s Platform dispute portal.

Post-rental inspection evidence management

Article 5(b) — Contract. Creating, storing, and sharing inspection records for the purpose of assessing post-rental charges and resolving damage disputes.

Customer support

Article 5(b) — Contract; Article 5(e) — Legitimate interest. Responding to your support requests, complaints, and feedback.

Legal compliance

Article 5(c) — Legal obligation. Complying with UAE government requests, court orders, regulatory requirements (DET, FTA, UAE Data Office, UAE Central Bank).

VAT invoicing and tax compliance

Article 5(c) — Legal obligation. Issuing VAT-compliant invoices per Federal Decree-Law No. 8 of 2017 and maintaining required tax records.

Platform improvement and analytics

Article 4 — Consent (non-essential analytics); Article 5(e) — Legitimate interest (aggregated, anonymised analytics). Understanding how the Platform is used to develop new features.

Service communications

Article 5(b) — Contract. Sending booking confirmations, payment notifications, post-rental charge notifications, cancellation notices, and policy updates.

Marketing communications (CarEjar services only)

Article 4 — Explicit consent. Sending promotional emails or push notifications about CarEjar offers. You may opt out at any time via unsubscribe links or app notification settings.

We do NOT use your personal data for: selling to third-party advertisers; automated decision-making that produces significant legal effects without human review; profiling for purposes unrelated to your use of the Platform; or any purpose you have not been informed of in this Policy.

SECTION 4: WHO WE SHARE YOUR DATA WITH

CarEjar does not sell, rent, or trade your personal data to third parties. We share your data only in the following circumstances and only to the extent necessary for the stated purpose:

4.1 Rental Agencies

When you make a Booking, CarEjar shares the minimum personal data necessary for the Agency to fulfil your Booking with the relevant Agency. This includes:

  • Your first name and last name;
  • Your Booking reference, vehicle details, rental dates, and pick-up location;
  • Your driving licence details (for verification at pick-up);
  • Emergency contact number (if provided).

We do NOT share your full email address, payment details, or home address with Agencies. Agencies are contractually bound (under the Agency Agreement and Agency T&C) to use your data only for the specific Booking and to comply with UAE PDPL as Data Processors under CarEjar’s instructions.

4.2 Payment Processor — Stripe

Stripe Payments Europe Ltd and its affiliates process all payment transactions on the Platform. Stripe receives your tokenised payment method credentials, transaction amounts, billing address, and fraud detection signals. Stripe is an independent Data Controller for its own compliance purposes and is PCI-DSS certified. Stripe’s Privacy Policy: stripe.com/gb/privacy. Stripe may process your data in the USA, EU, and other jurisdictions under Standard Contractual Clauses and equivalent transfer mechanisms.

4.3 Technology and Service Providers

We engage trusted third-party service providers to operate the Platform. These providers process personal data on our behalf as Data Processors under written data processing agreements compliant with UAE PDPL:

  • Cloud infrastructure: AWS / Google Cloud (encrypted data storage, UAE and regional data centres where available);
  • Analytics: Google Analytics, Mixpanel (anonymised/aggregated usage data only);
  • Error monitoring: Sentry (crash reports and technical logs);
  • Customer support: Intercom (support chat — name, email, and conversation content);
  • Email delivery: SendGrid / AWS SES (transactional emails — booking confirmations, notifications);
  • KYC / Identity verification: CarEjar uses their own verification protocol document and selfie verification — data processed under strict security standards.
  • Mapping services: Google Maps Platform (pick-up/drop-off location display — no personal data stored beyond session).

4.4 UAE Government Authorities and Law Enforcement

CarEjar may disclose your personal data to UAE government authorities, regulatory bodies, law enforcement agencies, or courts of competent jurisdiction:

  • In response to a valid legal process (court order, official notice, regulatory request);
  • To comply with UAE Federal Decree-Law No. 20 of 2018 (AML) mandatory reporting obligations;
  • To comply with UAE Federal Traffic Law No. 21 of 1995 obligations in connection with traffic violations on rented vehicles;
  • To respond to requests from the UAE Data Office under UAE PDPL; or
  • Where we have a good-faith belief that disclosure is necessary to prevent fraud, protect CarEjar’s legal rights, or protect the safety of Users or the public.

Where permitted by law, we will notify you of such requests before complying.

4.5 Professional Advisors

We may share your data with our lawyers, auditors, accountants, and insurance advisors under confidentiality obligations, where necessary for legal compliance, audit, or dispute proceedings.

4.6 Business Transfers

If CarEjar undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will notify you by email and via a Platform notice before any such transfer occurs and before your data becomes subject to a different privacy policy.

4.7 What We DO NOT Do

  • We do NOT sell your personal data to advertisers, data brokers, or any third party for commercial purposes;
  • We do NOT share your full payment details (card number, CVV) with anyone — not even Agencies;
  • We do NOT share your personal data with third parties for their own independent marketing purposes without your explicit consent;
  • We do NOT use your personal data to serve third-party advertising on the CarEjar Platform. CarEjar products are ad-free.

SECTION 5: INTERNATIONAL DATA TRANSFERS

CarEjar is based in Dubai, UAE. Some of our third-party service providers (including Stripe, Google, Mixpanel, Sentry, and Intercom) are based in the United States of America and may process your personal data outside the UAE.

Where we transfer personal data outside the UAE, we ensure appropriate safeguards are in place in compliance with UAE PDPL (Federal Decree-Law No. 45 of 2021) and applicable UAE Data Office guidance on cross-border transfers. These safeguards include:

  • Standard Contractual Clauses (SCCs) incorporated into our data processing agreements with service providers;
  • Adequacy assessments confirming the destination country provides an equivalent level of data protection;
  • Membership of the EU-US Data Privacy Framework or equivalent certification schemes;
  • Binding Corporate Rules (BCRs) approved by competent data protection authorities.

You may request a copy of the specific transfer safeguards applicable to any third-party provider by emailing dpo@carejar.net.

SECTION 6: HOW LONG WE KEEP YOUR DATA — RETENTION SCHEDULE

We keep your personal data only for as long as necessary for the purposes set out in this Policy, or as required by applicable UAE law. The following retention schedule applies:

Data Category

Retention Period and Legal Basis

Identity / KYC documents (passport, Emirates ID, driving licence)

5 years from account closure or last transaction — required by UAE AML Law (Federal Decree-Law No. 20 of 2018).

Booking and transaction records

5 years from Booking date — required by UAE Commercial Transactions Law (Federal Law No. 18 of 1993).

Payment records and invoices

5 years from transaction date — required by UAE VAT Law (Federal Decree-Law No. 8 of 2017) and FTA requirements.

Post-rental inspection records and evidence

3 years from Booking date — required for potential chargeback and legal proceedings. Consistent with Platform T&C Clause 9.2.1.

Dispute records

5 years from dispute resolution — required for legal proceedings limitation periods under UAE law.

Account data (contact details, preferences)

Duration of account plus 2 years after closure.

Support communications

3 years from last interaction.

Marketing consent records

Until consent is withdrawn, plus 2 years for evidence of consent.

Security and fraud logs (IP address, device data)

12 months from creation.

Analytics data (anonymised)

Indefinitely — once fully anonymised, no longer constitutes personal data under UAE PDPL.

Cookie consent records

12 months from consent — see Cookie Policy.

After the applicable retention period expires, we will securely delete, anonymise, or destroy your personal data. If you request deletion before the end of the retention period, we will comply except where retention is required by UAE law or is necessary to defend legal proceedings.

SECTION 7: YOUR RIGHTS UNDER UAE PDPL

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you have the following rights regarding your personal data:

Your Right

What It Means and How to Exercise It

Right of Access

You may request a copy of the personal data CarEjar holds about you. We will provide a structured, readable copy within 30 days of your verified request. Email dpo@carejar.net with subject ‘Data Access Request’ and your account email address.

Right of Rectification

You may request correction of any inaccurate or incomplete personal data. For account data (name, contact details), you can update most information directly in the CarEjar app under Profile → Settings. For document data (driving licence, ID), email dpo@carejar.net.

Right of Erasure (Right to be Forgotten)

You may request deletion of your personal data where: (a) it is no longer necessary for the purposes collected; (b) you have withdrawn consent and no other legal basis applies; or (c) processing is unlawful. We will comply subject to our legal retention obligations (see Section 6). Note: deleting your account will not automatically erase data we are legally required to retain.

Right of Restriction

You may request that we restrict (suspend) processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending our verification.

Right to Object

You may object to processing based on legitimate interest. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. You may always object to processing for direct marketing purposes — we will stop immediately.

Right of Data Portability

You may request a copy of personal data you have provided to us (account data, booking history) in a structured, commonly used, machine-readable format (e.g. JSON or CSV) to transfer to another service provider.

Right to Object to Automated Decision-Making

You have the right to object to decisions made solely by automated processing that produce significant legal or similarly significant effects on you. CarEjar does not currently make binding automated decisions affecting legal rights, but will inform you if this changes.

Right to Withdraw Consent

Where processing is based on your consent (e.g. marketing, non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing. Withdraw marketing consent via the ‘unsubscribe’ link in any email or in-app notification settings. Withdraw cookie consent via the Cookie Preference Centre.

To exercise any of the above rights, contact our Data Protection Officer at dpo@carejar.net. Include your account email address and a description of your request. We may need to verify your identity before processing your request. We will respond within 30 calendar days.

COMPLAINTS: If you are dissatisfied with our response to your rights request, or believe we are processing your data unlawfully, you may file a complaint with:

  • UAE Data Office (competent supervisory authority under UAE PDPL): www.uaedataoffice.gov.ae
  • Dubai DET Consumer Protection Department: For consumer rights complaints relating to CarEjar’s services.

SECTION 8: HOW WE PROTECT YOUR DATA — SECURITY MEASURES

CarEjar implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction, in compliance with UAE Federal Decree-Law No. 34 of 2021 (Cybercrimes Law) and UAE PDPL Article 13.

8.1 Technical Security Measures

  • Encryption in transit: All data transmitted between your device and CarEjar’s servers is encrypted using TLS 1.2 or higher (HTTPS);
  • Encryption at rest: All sensitive personal data (identity documents, payment tokens, KYC data) is stored using AES-256 encryption;
  • Payment tokenisation: Card credentials are processed and stored exclusively by Stripe in PCI-DSS compliant infrastructure — CarEjar never holds raw card numbers;
  • Access controls: CarEjar staff access to personal data is role-based and restricted to the minimum necessary for their function (principle of least privilege);
  • Multi-factor authentication: Required for all CarEjar administrative system access;
  • Regular penetration testing: CarEjar’s Platform undergoes periodic security testing to identify and remediate vulnerabilities;
  • Intrusion detection: Automated monitoring for suspicious access patterns, unusual transaction volumes, and potential data breaches.

8.2  Organisational Security Measures

  • Data Protection Officer: A designated DPO (dpo@carejar.net) oversees privacy compliance;
  • Staff training: All CarEjar staff with access to personal data receive regular privacy and security training;
  • Vendor due diligence: All third-party processors are subject to security assessments and contractual data protection obligations before engagement;
  • Incident response plan: CarEjar maintains a documented data breach response procedure.

8.3  Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, CarEjar will:

  • Notify the UAE Data Office without undue delay and within 72 hours of becoming aware of the breach (where required by UAE PDPL);
  • Notify affected individuals directly by email where the breach is likely to result in a high risk to their rights and freedoms, describing the nature of the breach, the data affected, likely consequences, and measures taken or proposed; and
  • Maintain an internal breach register documenting all breaches regardless of whether external notification is required.

Despite our security measures, no digital system is completely immune to breaches. If you suspect your CarEjar account has been compromised, please contact support@carejar.net immediately and change your password.

SECTION 9: CHILDREN’S PRIVACY

The CarEjar Platform is designed for use by adults aged 21 and over. We do not knowingly collect personal data from persons under 21 years of age. Our minimum age requirement of 21 (reflecting UAE insurance underwriting standards) applies to all Registered Users and to all Bookings.

If we become aware that we have inadvertently collected personal data from a person under 21, we will promptly delete that data. If you are a parent or guardian and believe your child has provided personal data to CarEjar, please contact dpo@carejar.net immediately.

SECTION 10: AUTOMATED DECISION-MAKING AND PROFILING

CarEjar uses automated tools and algorithms in limited circumstances:

10.1   FRAUD DETECTION: CarEjar’s payment processor (Stripe) and fraud detection tools use automated analysis of transaction patterns to identify potentially fraudulent transactions. This may result in an automatic hold being placed on a booking payment pending manual review. If your transaction is flagged, we will contact you directly. You have the right to request human review of any automated fraud determination.

10.2   VEHICLE RECOMMENDATIONS: CarEjar may use your search history and stated preferences to surface relevant vehicle listings. This is a personalisation feature only and does not produce legal effects.

10.3   DYNAMIC PRICING: Rental prices are set by Agencies. CarEjar’s Platform Service Fees (as set out in the Agency Contract) are fixed or formula-based and do not involve individualised automated pricing against you personally.

10.4   NO BINDING AUTOMATED DECISIONS: CarEjar does not make any binding decisions about your legal rights, eligibility, or financial liability solely through automated means without human review. All post-rental charge disputes are reviewed by CarEjar’s human disputes team before any determination is finalised.

SECTION 11: MIT PAYMENT MANDATE AND PRIVACY

By making a Booking on the Platform, you grant CarEjar a standing payment authorisation (MIT mandate) to charge your stored payment credentials for post-rental charges within 90 days of vehicle return, as fully described in Platform T&C Section 5 and Schedule 1.

From a privacy perspective, this means:

  • Your tokenised payment credentials (Merchant Token / MPAN) are retained by Stripe for the duration of your account lifetime or until you withdraw consent, whichever is earlier;
  • Transaction records of all MIT charges are retained for 5 years per our payment data retention policy in Section 6;
  • You will receive a written pre-charge notification (by email and in-app) containing the charge amount and supporting evidence before any MIT post-rental charge is processed — giving you 24 hours to review it;
  • Your payment records may be used as evidence in chargeback defence proceedings. We retain these records for the duration of any pending chargeback or legal proceedings.

To withdraw your MIT payment authorisation: Close your CarEjar account (which will prevent future bookings) or contact dpo@carejar.net. Note that withdrawal does not affect MIT charges already validly initiated within the 90-day window for a Booking you made prior to withdrawal.

SECTION 12: COOKIES AND TRACKING TECHNOLOGIES

CarEjar uses cookies and similar tracking technologies on its website and mobile applications. Our use of cookies is governed by our separate Cookie Policy, available at:

www.carejar.net/legal/cookie-policy

The Cookie Policy explains in detail: what types of cookies we use (Strictly Necessary, Functional, Analytics, Marketing); what each cookie does; which third parties set cookies on our Platform; how long cookies last; and how to manage or withdraw your cookie consent via our Cookie Preference Centre.

In summary: Strictly Necessary cookies are always active and required for the Platform to work. All other cookies require your consent, which you can give or withdraw at any time via the ‘Cookie Settings’ link in the footer of our website.

SECTION 13: AGENCY DATA PROCESSING

Where CarEjar engages Rental Agencies as Data Processors (i.e. to process User personal data on CarEjar’s behalf for the purpose of fulfilling Bookings), CarEjar has entered into a Data Processing Agreement (DPA) with each Agency as required by UAE PDPL.

Under these DPAs, Agencies are bound to:

  • Process User data only on CarEjar’s documented instructions and only for the specific Booking;
  • Implement appropriate security measures to protect User data;
  • Notify CarEjar within 24 hours of any personal data breach involving User data;
  • Delete or return all User data within 30 days of termination of the Agency Agreement; and
  • Not sub-process User data without CarEjar’s prior written consent.

Agency compliance with these obligations is audited periodically by CarEjar. Agencies that breach their data processing obligations may face account suspension and are personally liable for any resulting regulatory penalties.

SECTION 14: LINKS TO THIRD-PARTY WEBSITES AND SERVICES

The CarEjar Platform may contain links to third-party websites, apps, or services (such as Google Maps, government fine payment portals, or Agency websites). These third-party services have their own privacy policies, and CarEjar is not responsible for their privacy practices or content. We encourage you to read their privacy policies before providing any personal data to them.

SECTION 15: CHANGES TO THIS PRIVACY POLICY

CarEjar may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable UAE law, or changes to the services we offer. When we make material changes:

  • We will update the Effective Date on the cover page of this Policy;
  • We will display a prominent notice on the Platform for at least 14 days after the update;
  • We will notify registered Users by email where the changes materially affect how we use their data; and
  • Where changes require fresh consent, we will seek that consent before the new processing begins.

The current version of this Privacy Policy is always available at: www.carejar.net/legal/privacy-policy

We recommend reviewing this Policy periodically. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

SECTION 16: GOVERNING LAW AND UAE PDPL COMPLIANCE

This Privacy Policy is governed by and construed in accordance with the laws of the Emirate of Dubai and the Federal Laws of the United Arab Emirates. CarEjar’s data processing practices are designed to comply with the following UAE laws, which are incorporated by reference into this Policy:

  • UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its Executive Regulations;
  • UAE Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes (cybersecurity obligations);
  • UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism (KYC/AML data retention);
  • UAE Federal Decree-Law No. 8 of 2017 on Value Added Tax (tax record retention);
  • UAE Federal Law No. 18 of 1993 on Commercial Transactions (commercial record retention); and
  • UAE Federal Law No. 15 of 2020 on Consumer Protection (consumer data rights).

Any dispute relating to this Privacy Policy or CarEjar’s processing of personal data shall be subject to the jurisdiction of the Dubai Courts, with the right to refer complaints to the UAE Data Office as the competent supervisory authority.

SECTION 17: HOW TO CONTACT US

For any privacy-related queries, rights requests, complaints, or to report a suspected data breach, please use the following contacts. We aim to respond to all privacy enquiries within 30 calendar days.

Contact Type

Details

Data Protection Officer:

dpo@carejar.net — for all data subject rights requests and compliance enquiries

General Support:

info@carejar.net |

Cookie Preferences:

cookie-settings@carejar.net — or use the Cookie Preference Centre at www.carejar.net/legal/cookie-policy

UAE Data Office (Regulator):

www.uaedataoffice.gov.ae — to file a complaint if you are dissatisfied with our response

DET Consumer Protection:

Dubai Department of Economy and Tourism — for consumer rights complaints