Privacy policy

This Privacy Policy explains how Luxilo Car Rental LLC ("Luxilo", "we", "us", "our") collects, uses, stores and protects the personal data of visitors to our website and clients of our rental services. We are committed to handling your data lawfully and transparently in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and applicable data protection regulations.

1. Who we are

2. Personal data we collect

Depending on your interaction with us, we may collect:

When you contact us

• Name, phone number, email address
• Content of your messages (WhatsApp, email or phone enquiries)
• The vehicle, dates and any preferences you mention

When you rent a vehicle

• Full name, date of birth, nationality, contact details
• Passport details and Emirates ID (where applicable)
• Driving licence (UAE or home country) and International Driving Permit
• Credit card information for the security deposit and rental charges (handled by our payment processor — we do not store full card numbers)
• Photographs of the rented vehicle at pick-up and return for the Vehicle Check Report
• Signature on the rental agreement

Automatically collected from your device

Our website does not currently use tracking cookies or analytics. We do not profile visitors. If this changes in the future, this Privacy Policy will be updated and consent will be requested where required.

3. How we use your data

We use your personal data for the following purposes:

• Reservations and contracts: to handle your enquiry, prepare and execute the rental agreement, and provide our service.
• Billing and payment: to process the security deposit, rental charges, fines, Salik tolls, fuel and any damages.
• Customer service: to respond to your questions, manage incidents and improve our service.
• Legal and regulatory compliance: to fulfil our obligations under UAE law (RTA, Dubai Police, traffic department reporting, anti-money-laundering, tax records).
• Insurance and accident management: to share required information with insurers, claim adjusters and authorities in the event of an accident or incident.
• Eligibility verification: when you choose the no-deposit option, to verify your eligibility through our partner Blacklist.

4. Legal basis for processing

We process your personal data on the following legal grounds, under the UAE PDPL:

• Performance of a contract (your rental agreement with us)
• Legal obligation (RTA, police, tax, anti-money-laundering rules)
• Legitimate interest (fraud prevention, vehicle protection, debt recovery)
• Consent (where you have actively opted in, e.g. marketing communications — currently not solicited)

5. Who we share your data with

Your data is never sold. We share it only with the following categories of recipients, and only to the extent necessary:

• UAE authorities — Dubai Police, Roads and Transport Authority (RTA), Traffic Department, Criminal Investigation Department, immigration authorities — when required by law or in connection with a traffic incident, fine, accident or investigation.
• Insurance providers and claim adjusters in the event of an accident, theft or damage claim.
• Payment processors and banks for the secure handling of payments and chargebacks.
• Blacklist — our trusted partner — when you select the no-deposit option, for eligibility verification and risk management.
• Professional advisors (legal counsel, accountants, auditors) bound by confidentiality.
• IT and hosting providers for the operation of our website and internal systems, under appropriate confidentiality and security commitments.

We do not transfer your personal data to recipients outside the United Arab Emirates unless required for the legitimate purposes listed above and subject to adequate safeguards.

6. How long we keep your data

We retain personal data only as long as necessary for the purposes for which it was collected:

• Rental contract data: for the duration of the rental and a minimum of 5 years after the end of the contract, in accordance with UAE commercial law and tax retention requirements.
• Identity documents (passport, licence): retained for the duration of the rental and as required by law.
• Payment data: retained as required by financial regulations.
• Pre-rental enquiries (WhatsApp, email): up to 24 months after the last interaction, unless a contract is signed.
• Accident and incident files: until the matter is fully resolved, plus the applicable limitation period.

7. Your rights

Under the UAE PDPL, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right of rectification — ask us to correct inaccurate or incomplete data.
• Right of deletion — request deletion of your data, subject to our legal retention obligations.
• Right to object or restrict processing — for processing based on legitimate interest.
• Right to data portability — receive your data in a structured, commonly used format.
• Right to withdraw consent — at any time, where processing was based on consent.
• Right to lodge a complaint — with the UAE Data Office or the competent authority.

To exercise any of these rights, please contact us at contact@driveluxilo.com. We will respond within the timeframes set by applicable law.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption of sensitive data, secure storage of physical documents, and confidentiality obligations on our staff and partners.

Despite our best efforts, no system is completely secure. If you have reason to believe your data with us has been compromised, please contact us immediately at contact@driveluxilo.com.

9. Cookies & tracking

This website does not currently set tracking cookies, advertising pixels or analytics scripts. Only essential technical cookies (e.g. for session management, if any) may be used. If we introduce analytics or marketing technologies in the future, we will update this policy and request your consent where required.

10. Children

Our services are not directed at minors. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us so we may delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service or legal requirements. The version in effect is always the one published on this page; the date of last update is shown above. We encourage you to review this policy periodically.

12. Contact