Privacy Policy

This policy explains how ET TRAVEL FZ-LLC, operator of the Dubigate B2B platform at dubigate.com, collects, uses, shares, stores and protects personal data. It is written in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").

1. Who this policy covers

Dubigate is a business-to-business platform. We handle personal data of two different groups:

• Agency users — the staff of registered travel agencies who hold accounts on the Platform.
• Travellers — the end customers on whose behalf an Agency makes a booking or submits a visa application. We receive traveller data from the Agency; we do not collect it directly from the traveller.

Where an Agency uploads traveller data, the Agency is responsible for having obtained that traveller's informed consent before doing so.

2. What we collect

From Agencies

• Company name, trade licence details and licence document, country of operation
• Contact person name, business email address, phone and WhatsApp number
• Account credentials (passwords are stored only in hashed form; we never see them)
• Balance top-up records, payment receipts, invoices and transaction history
• Technical data: IP address, browser type, timestamps and security logs

From Agencies about Travellers

• Ticket bookings: lead traveller name, number and type of guests, travel date, and contact details where the supplier requires them
• Visa applications: full name, date of birth, nationality, gender, passport number and expiry, passport scan, personal photograph, and any supporting documents required by the authorities

We do not knowingly collect data relating to children except where a child is a named traveller on a booking or visa application submitted by the Agency.

3. Why we use it and on what basis

Purpose	Legal basis under the PDPL
Creating and administering an Agency account; verifying the business	Performance of a contract
Issuing tickets and delivering bookings	Performance of a contract
Submitting visa applications to the competent authorities	Performance of a contract; consent obtained by the Agency from the traveller
Processing balance top-ups, invoicing and accounting	Legal obligation; performance of a contract
Fraud prevention, security monitoring and audit logging	Legitimate interest of the controller
Support, service notifications and operational messages	Performance of a contract

We do not sell personal data, and we do not use traveller data for marketing.

4. Who we share it with

We share only what is necessary, only with parties who need it to deliver the service:

• Attraction operators and ticket distributors — traveller names and booking details required to issue and validate tickets.
• UAE government authorities — visa application data, so the application can be filed; and any data required by law.
• Technology providers that host and run the Platform, acting on our instructions: Supabase (database and authentication), Vercel (website hosting), Cloudflare (bot protection), and our email delivery provider.
• Professional advisers, auditors and banks, where necessary for accounting, legal or compliance purposes.

We do not share Agency commercial data — such as your cost prices, margins or customer list — with other agencies or with any third party for their own purposes.

5. Where data is stored

Our database and file storage are operated by Supabase and our website by Vercel; their servers may be located outside the United Arab Emirates. Where personal data is transferred abroad, we rely on providers who apply an adequate level of protection and contractual safeguards, as permitted under Articles 22 and 23 of the PDPL. Visa data is transmitted to UAE-based providers and authorities.

6. How long we keep it

Data	Retention period
Passport scans, personal photographs and visa supporting documents	12 months after the visa outcome is issued, then deleted
Visa application record (name, status, dates — without document files)	5 years, as part of the transaction record
Booking records, invoices, balance and payment history	5 years, to meet UAE accounting and tax record-keeping obligations
Agency account and contact details	While the account is active, plus 12 months after closure
Security and admin audit logs	24 months

Where a longer period is required by law or by an ongoing dispute, investigation or audit, we retain the relevant data until that requirement ends.

7. How we protect it

• All traffic to and from the Platform is encrypted in transit (HTTPS/TLS).
• Database access is restricted by row-level security, so each Agency account can reach only its own records.
• Passports, photographs and agency documents are stored in private storage buckets and are never publicly accessible; they are served only through short-lived signed links to authorised users.
• Administrative access requires two-factor authentication, enforced at the database level and not only in the interface.
• Passwords are stored only as salted hashes. Neither we nor our staff can read them.
• Login is protected by Cloudflare Turnstile against automated attacks.
• Changes made by administrators to balances, bookings and applications are written to an audit log.

No system can be guaranteed absolutely secure. If a personal data breach occurs that is likely to cause harm, we will notify the UAE Data Office and the affected parties without undue delay, as required by Article 9 of the PDPL.

8. Your rights

Under the PDPL, individuals whose data we hold may:

• request access to their personal data and information about how it is processed;
• request correction of inaccurate or incomplete data;
• request deletion of their data, where we are not required to keep it;
• request restriction of, or object to, certain processing;
• request their data in a portable format;
• withdraw consent where processing is based on consent.

Requests can be sent to info@dubigate.com. We respond within 30 days. Travellers should normally address their request to the Agency that made the booking; if a traveller contacts us directly, we will verify identity before acting and may need to involve the relevant Agency.

Individuals also have the right to lodge a complaint with the UAE Data Office.

9. Cookies and tracking

The Platform uses only what is necessary to work:

• Session storage — keeps you signed in during a session. Without it you would be logged out on every page load.
• Cloudflare Turnstile — sets a short-lived token to distinguish real users from automated attacks on the login and registration forms.

We do not use advertising cookies, cross-site tracking, analytics profiling or third-party marketing pixels.

10. Changes to this policy

We may update this policy. The current version is always published on this page with its update date. Where a change materially affects how we handle personal data, we will notify registered agencies through the Platform or by email.

11. Contact

ET TRAVEL FZ-LLC — FDRK5374, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
Email: info@dubigate.com · WhatsApp: +971 52 897 8869