Privacy policy

This Privacy Policy explains how Luxilo Car Rental LLC ("Luxilo", "we", "us", "our") collects, uses, stores and protects the personal data of visitors to our website and clients of our rental services. We are committed to handling your data lawfully and transparently in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and applicable data protection regulations.

1. Who we are

2. Personal data we collect

Depending on your interaction with us, we may collect:

When you contact us

• Name, phone number, email address
• Content of your messages (WhatsApp, email or phone enquiries)
• The vehicle, dates and any preferences you mention

When you rent a vehicle

• Full name, date of birth, nationality, contact details
• Passport details and Emirates ID (where applicable)
• Driving licence (UAE or home country) and International Driving Permit
• Credit card information for the security deposit and rental charges (handled by our payment processor — we do not store full card numbers)
• Photographs of the rented vehicle at pick-up and return for the Vehicle Check Report
• Signature on the rental agreement

Automatically collected from your device

With your consent, Google Analytics 4 automatically collects aggregate usage data — pages viewed, traffic source, and general device and browser information — as described in section 9 below. We do not use this to build advertising profiles.

3. How we use your data

We use your personal data for the following purposes:

• Reservations and contracts: to handle your enquiry, prepare and execute the rental agreement, and provide our service.
• Billing and payment: to process the security deposit, rental charges, fines, Salik tolls, fuel and any damages.
• Customer service: to respond to your questions, manage incidents and improve our service.
• Legal and regulatory compliance: to fulfil our obligations under UAE law (RTA, Dubai Police, traffic department reporting, anti-money-laundering, tax records).
• Insurance and accident management: to share required information with insurers, claim adjusters and authorities in the event of an accident or incident.
• Eligibility verification: when you choose the no-deposit option, to verify your eligibility through our partner Blacklist.

4. Legal basis for processing

We process your personal data on the following legal grounds, under the UAE PDPL:

• Performance of a contract (your rental agreement with us)
• Legal obligation (RTA, police, tax, anti-money-laundering rules)
• Legitimate interest (fraud prevention, vehicle protection, debt recovery)
• Consent (where you have actively opted in, e.g. marketing communications — currently not solicited)

5. Who we share your data with

Your data is never sold. We share it only with the following categories of recipients, and only to the extent necessary:

• UAE authorities — Dubai Police, Roads and Transport Authority (RTA), Traffic Department, Criminal Investigation Department, immigration authorities — when required by law or in connection with a traffic incident, fine, accident or investigation.
• Insurance providers and claim adjusters in the event of an accident, theft or damage claim.
• Payment processors and banks for the secure handling of payments and chargebacks.
• Blacklist — our trusted partner — when you select the no-deposit option, for eligibility verification and risk management.
• Professional advisors (legal counsel, accountants, auditors) bound by confidentiality.
• IT and hosting providers for the operation of our website and internal systems, under appropriate confidentiality and security commitments.

We do not transfer your personal data to recipients outside the United Arab Emirates unless required for the legitimate purposes listed above and subject to adequate safeguards.

6. How long we keep your data

We retain personal data only as long as necessary for the purposes for which it was collected:

• Rental contract data: for the duration of the rental and a minimum of 5 years after the end of the contract, in accordance with UAE commercial law and tax retention requirements.
• Identity documents (passport, licence): retained for the duration of the rental and as required by law.
• Payment data: retained as required by financial regulations.
• Pre-rental enquiries (WhatsApp, email): up to 24 months after the last interaction, unless a contract is signed.
• Accident and incident files: until the matter is fully resolved, plus the applicable limitation period.

7. Your rights

Under the UAE PDPL, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right of rectification — ask us to correct inaccurate or incomplete data.
• Right of deletion — request deletion of your data, subject to our legal retention obligations.
• Right to object or restrict processing — for processing based on legitimate interest.
• Right to data portability — receive your data in a structured, commonly used format.
• Right to withdraw consent — at any time, where processing was based on consent.
• Right to lodge a complaint — with the UAE Data Office or the competent authority.

To exercise any of these rights, please contact us at contact@driveluxilo.com. We will respond within the timeframes set by applicable law.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption of sensitive data, secure storage of physical documents, and confidentiality obligations on our staff and partners.

Despite our best efforts, no system is completely secure. If you have reason to believe your data with us has been compromised, please contact us immediately at contact@driveluxilo.com.

9. Cookies & tracking

We use a small number of cookies and similar browser storage:

• Essential & functional (always active): first-party items stored in your browser to make the site work — your cookie choice, your preferred display currency and cached exchange rates, your saved (favourite) vehicles, and your language selection. These are not used to track you across other websites.
• Analytics — Google Analytics 4 (consent required): with your consent, Google Analytics 4 sets cookies (such as _ga) so we can understand how visitors use the site — pages viewed, traffic sources and aggregate interactions — and improve it. These are only set after you accept them.

On your first visit, analytics stays switched off until you choose. You can accept or decline in the consent banner, and change your decision at any time via the “Manage cookies” link in the footer. We do not use advertising or profiling cookies. More on Google’s processing: Google Privacy Policy.

10. Children

Our services are not directed at minors. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us so we may delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service or legal requirements. The version in effect is always the one published on this page; the date of last update is shown above. We encourage you to review this policy periodically.

12. Contact