Privacy Policy

1. Scope and roles

This Privacy Policy describes how Garagii Automotive Solutions L.L.C. ("Garagii", "we", "us") collects, uses, stores and protects personal data through the Garagii.rent software platform and this website.

Under the UAE Personal Data Protection Law we act in two roles:

• Data Controller for the personal data of our clients' business representatives, account administrators, and visitors to this website.
• Data Processor for the personal data that rental agencies (our clients) upload into the Platform about their own customers, such as Emirates ID, passport and driving-licence details, rental contracts, fine records and inspection photos. For that data, the rental agency is the Data Controller and we act on its instructions.

2. Information we collect

A. Client business data (as Controller)

• Company details: company name, trade licence, tax registration number, business address.
• Account administrator details: full name, email address, phone number, job title, authentication credentials.
• Billing details: invoices issued to the client and payment records. We do not store full payment-card numbers.

B. Platform technical data

• Log data: IP address, device type, browser, access timestamps and activity logs, used for security, audit trails and reliability.

C. End-customer data processed on behalf of clients (as Processor)

• Identification documents: data and copies of Emirates ID, passport, visa and driving licence.
• Rental contracts: vehicle, dates, amounts, mileage, electronic signatures and the time they were given.
• Traffic and compliance data: Salik and toll usage, traffic fines, and vehicle inspection photos.
• Network flags: where a client records that a customer defaulted on payment, did not return a vehicle, caused damage or left an unrecovered fine, the Platform stores the category of the event, the date and a one-way cryptographic hash of the customer's Emirates ID or passport number; the number itself is never stored in the shared record or shown to other clients. Other clients can see only that a flag exists, its category, its date and how many clients raised one; never the customer's name, documents or contact details, nor which client raised it. Flags expire after 24 months and are cleared by the raising client once the matter is settled. The client that raised a flag is the Controller of it and must have informed the customer in its rental terms.

D. Client staff and drivers (as Processor)

• Users and drivers of a client company: name, role, phone number, and the task or job messages addressed to them, including notifications delivered over WhatsApp or SMS. We process this on the client's instructions; the client is the Controller and is responsible for obtaining each person's permission to be contacted on that channel.

E. Chauffeur directory

• Drivers listed by clients: name, licence status, contact details where the driver provides them, and availability, listed only with the driver's explicit, recorded consent obtained by the listing client. A driver may ask us or the listing client to remove the listing at any time.

F. This website

• The website runs no analytics or advertising trackers and sets a single cookie (lang) to remember your language choice. When you contact us on WhatsApp or by email, we use what you send only to answer your enquiry.

3. Legal basis for processing

• Performance of a contract: to deliver the service under our agreement with each client.
• Legal obligations: compliance with UAE tax law, commercial record-keeping requirements, and lawful requests from authorities.
• Legitimate interests: audit trails, security monitoring, fraud prevention and platform reliability.

4. Security, storage and cross-border transfers

4.1. Security. We apply technical and organisational safeguards including encryption of data in transit and at rest, role-based access control so that each user sees only what their role allows, strict separation of each client's data, and logging of access to records.

4.2. Cross-border transfers. Where hosting or sub-processing takes place outside the UAE, we use providers and regions that offer an adequate level of protection, or contractual safeguards providing equivalent protection, as required by the PDPL.

5. Sharing and retention

5.1. No sale of data. We never sell, rent or otherwise monetise personal data or clients' operational data.

5.2. Between clients on the Platform. When two rental agencies transact on the B2B network, each sees the other's company details, licence information and vehicle data needed for the deal. No client can see another client's customers or bookings.

5.3. Service providers. Data may be shared with sub-processors solely to operate the service:

• cloud hosting and infrastructure providers;
• messaging providers used to deliver documents and notifications to customers, staff and drivers, namely WhatsApp (Meta Platforms, Inc.) and SMS carriers;
• a voice-generation provider used to turn written task summaries into spoken messages for drivers; it receives the task text and the chosen language, and no customer identification, contract or payment data;
• payment providers.

Data is disclosed to government or police authorities only when required by a formal legal request, court order or statutory duty under UAE law.

5.4. Retention. Personal data is kept for as long as needed to provide the service and for the periods required by UAE law. Financial and tax records, including invoices, are retained for at least five (5) years as required by UAE tax legislation. A client may request export or deletion of its data on termination, subject to those statutory periods.

6. Your rights

Subject to the exceptions in the PDPL, individuals whose personal data we control may ask us to:

• Access the personal data we hold about them;
• Correct inaccurate or incomplete data;
• Delete personal data, where no statutory retention period or legal claim requires us to keep it;
• Withdraw consent to marketing communications at any time.

For end-customer data that a rental agency has uploaded into the Platform, we act as Processor: please direct your request to that rental agency, which is the Controller, and we will support it in responding.

7. Changes to this policy

We may update this policy as the service or the law changes. The effective date at the top shows the current version; material changes are communicated to clients in advance.

8. Contact

For privacy enquiries, to exercise your rights, or for compliance matters:

Garagii Automotive Solutions L.L.C.
Attn: Data Protection Officer
Dubai, United Arab Emirates
Email: founder@garagii.ae