UAE Personal Data Protection Compliance Statement

This statement describes Book GCC Trip's approach to compliance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"). It is a statement of our practices as our platform and operations grow, not a claim of a specific third-party certification or formal regulatory registration.

This is a focused, UAE-law-specific companion to our main Privacy Policy — it does not restate everything the Privacy Policy covers about what data we collect, why, and how we secure it. Read this statement together with our Privacy Policy, which remains the primary document describing our overall data practices.

1. Definitions

"UAE PDPL":

UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, as amended or replaced from time to time.

"Data Subject":

the individual to whom personal data relates — typically you, our guest or account holder.

"UAE Data Office":

the UAE federal authority responsible for overseeing implementation of, and issuing guidance under, the UAE PDPL.

"Personal Data":

as defined in our Privacy Policy — information relating to an identified or identifiable individual.

2. Scope of This Statement

This statement applies to personal data we process about you in connection with your use of the Book GCC Trip platform and your hotel bookings, to the extent the UAE PDPL applies to that processing. It is intended for guests and account holders who want to understand their rights under UAE law specifically, in addition to the general commitments in our Privacy Policy.

3. How This Statement Relates to Our Privacy Policy

Our Privacy Policy identifies who is responsible for your personal data and sets out, in full, what we collect, why, who we share it with, how long we keep it, and how we secure it. This statement does not repeat that detail — it focuses specifically on the rights the UAE PDPL gives you and how to exercise them. If anything in this statement appears to conflict with the Privacy Policy on a point of practice rather than a point of UAE PDPL rights, the Privacy Policy controls.

4. Personal Data Covered

This statement covers the same categories of personal data described in our Privacy Policy — account data, booking and payment data, hotel-guest data, device and analytics data, and communications data — to the extent that data is processed in a way the UAE PDPL applies to.

5. Your Rights Under the UAE PDPL

Subject to the exceptions the UAE PDPL itself allows, you have the following rights over your personal data:

• Access — request confirmation of whether we process your personal data, and a copy of it.
• Correction — request that we correct or update inaccurate or incomplete personal data.
• Erasure — request that we delete your personal data, subject to any retention we are required or entitled to keep.
• Restriction — request that we limit how we use your personal data in certain circumstances, rather than deleting it outright.
• Objection — object to certain processing, such as processing based on our legitimate interests or use of your data for marketing.
• Data portability, where applicable — request that certain data you provided to us be given to you, or transmitted to another provider, in a structured and commonly used format, where this is technically feasible.
• Withdrawal of consent — withdraw consent at any time for any processing that relies on it, without affecting the lawfulness of processing carried out before withdrawal.

6. How to Exercise These Rights

To exercise any of the rights listed in Section 5, contact us at support@bookgcctrip.com describing which right you would like to exercise and any details that help us locate your records, such as your account email or a booking reference. Our full Data Subject Rights procedure sets out the identity-verification steps we may take, our response-time target, and the limited circumstances in which a request may be restricted — for example, where we are legally required to retain certain financial or booking records.

7. Cross-Border Transfer Principles

Where personal data covered by the UAE PDPL is transferred outside the United Arab Emirates — for example, to a service provider that processes data in another country — we take reasonable steps appropriate to the circumstances to keep that data protected to a standard consistent with the UAE PDPL, regardless of where it is processed. Our Privacy Policy describes our general approach to international transfers in more detail.

8. The Role of the UAE Data Office

The UAE Data Office is the federal authority responsible for overseeing implementation of the UAE PDPL and issuing related guidance. If you are not satisfied with how we have handled a request under this statement, you may raise it with us first through our Complaint Handling Procedure, and you may also have the right to raise it with the UAE Data Office or another competent UAE authority.

9. Exceptions and Limitations

Rights under the UAE PDPL are not absolute. We may decline or limit a request where the law permits or requires us to — for example, where we must retain booking or payment records for a defined period under UAE financial or legal record-keeping obligations, or where fulfilling a request would infringe another person's rights. Where we decline or limit a request on this basis, we will explain why.

10. Changes to This Statement

We will update this statement as our data practices evolve and as UAE PDPL guidance develops. We will update the "Last updated" date above when we do. This statement does not assert that we hold any specific PDPL certification or formal regulatory approval beyond what is stated here.

Contact our support team at support@bookgcctrip.com or +971 54 339 3555 (09:00–18:00 UAE time, English; Arabic support planned for a future phase). If you are not satisfied with our response, see our Complaint Handling Procedure.