Data protection & privacy policy

1. Purpose of data collection

1.1 The Company collects and uses personal data solely to improve the Services and the User's experience of them. In particular, the data helps the Company to:

1. process vehicle shipping requests and documentation;
2. coordinate customs clearance, transport and tracking;
3. provide customer support and communication;
4. improve the performance of the Website and the user experience; and
5. meet its legal and compliance obligations.

1.2 The Company does not use personal data for unsolicited marketing, and does not sell, rent or disclose personal data to unaffiliated third parties.

2. Legal basis for Processing

2.1 The Company Processes Personal Data only where one of the following applies under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"):

1. the Data Subject has given consent to the Processing for one or more specific purposes;
2. the Processing is necessary for the performance of a contract to which the Data Subject is a party, or to take steps at the Data Subject's request before entering into such a contract;
3. the Processing is necessary for compliance with an obligation imposed on the Company by the laws of the United Arab Emirates; or
4. the Processing is necessary for the establishment, exercise or defence of legal claims.

2.2 The legal basis on which the Company relies for each purpose is set out below.

2.3 In this Policy, "Personal Data", "Processing" and "Data Subject" have the meanings given to them in the PDPL, and "Process" and "Processes" shall be construed accordingly.

3. What data we collect

3.1 The personal data collected by the Company may include:

1. full name, contact details and location;
2. vehicle information and service preferences;
3. communication records, such as emails and service enquiries; and
4. Website and usage analytics, in anonymised form.

3.2 The Company does not collect or retain sensitive information, such as government identification or financial data, unless specifically required by law (for example, for customs clearance or insurance).

4. How we protect your data

4.1 In compliance with UAE data protection laws and international standards, the Company:

1. uses secure servers, encryption and access controls;
2. allows personal data to be accessed only by authorised personnel for service-related tasks; and
3. regularly audits and updates its data security practices.

4.2 By the nature of the Services, Personal Data may be transferred outside the United Arab Emirates, including to carriers, agents, customs brokers and service providers in the country of destination. Such transfers shall be made only (a) to a jurisdiction approved under Article 22 of the PDPL as providing an adequate level of protection, or (b) otherwise as permitted under Article 23 of the PDPL, including where the transfer is necessary for the performance of a contract with the Data Subject, where the Data Subject has given express consent, or under a contract that requires the recipient to apply a level of protection equivalent to the PDPL.

5. Your rights

5.1 Subject to the PDPL, the Data Subject has the right to:

1. obtain information about the Processing of their Personal Data (Article 13);
2. receive their Personal Data in a structured, commonly used and machine-readable format and request its transfer to another controller (Article 14);
3. request the correction or erasure of their Personal Data (Article 15);
4. request the restriction of Processing (Article 16);
5. request that Processing be stopped (Article 17); and
6. object to decisions based solely on automated Processing that produce legal consequences or seriously affect the Data Subject (Article 18).

5.2 Where Processing is based on consent, the Data Subject may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal.

5.3 Requests shall be sent to privacy@freightmycar.com. The Company shall respond without undue delay and within any period prescribed by applicable law.

5.4 A Data Subject who considers that the Processing of their Personal Data breaches the PDPL may lodge a complaint with the UAE Data Office.

6. Data retention

6.1 The Company retains Personal Data only for as long as necessary for the purposes for which it was collected, in accordance with the following periods:

1. Quote requests and enquiries that do not result in a booking: 24 months from the last contact;
2. Booking, shipment, customs and insurance records: 7 years from completion of the shipment;
3. Invoices, accounting and tax records: 7 years from the end of the relevant tax period;
4. Marketing preferences: until consent is withdrawn, after which a suppression record is kept to give effect to the withdrawal;
5. Website analytics data: 14 months;
6. Server and security logs: up to 90 days.

6.2 At the end of the applicable period, Personal Data shall be deleted or anonymised, save where a longer period is required by law or for the establishment, exercise or defence of legal claims.

7. International visitors

7.1 Although the Company's data processing is based in the UAE, the Company recognises and respects the data protection expectations of international Users, and aims to ensure:

1. GDPR compliance for residents of the European Union;
2. CCPA alignment for Users in California; and
3. data security for Users in Asia, Africa and other regions, in accordance with local and international best practice.

8. Children

8.1 The Services are not directed at persons under the age of 18. The Company does not knowingly collect Personal Data from persons under the age of 18. Where the Company becomes aware that it has done so, it shall delete that data without undue delay.

9. Automated decision-making

9.1 The Company does not make decisions based solely on automated Processing that produce legal consequences for, or seriously affect, a Data Subject.

10. Personal Data breaches

10.1 Where the Company becomes aware of a breach that may prejudice the privacy, confidentiality or security of Personal Data, it shall notify the UAE Data Office and, where required, the affected Data Subjects, in accordance with Article 9 of the PDPL.

11. Updates to this policy

11.1 The Company may revise this Policy from time to time to keep it current with legal requirements and industry standards. Changes shall be posted on this page, and material updates shall be communicated where required.

12. Statutory rights and liability

12.1 Nothing in this Policy limits or excludes any right of a Data Subject under the PDPL, or any liability that cannot be limited or excluded under applicable law. Subject to the foregoing, the liability of the Company in connection with the Services is governed by the Terms and Conditions.

13. Severability

13.1 If any provision of this Policy is held to be invalid or unenforceable, that provision shall be limited to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

14. Governing law and jurisdiction

14.1 This Policy shall be governed by and construed in accordance with the laws of the United Arab Emirates as applied in the Emirate of Dubai, including the PDPL. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of the Emirate of Dubai. Nothing in this clause affects the right of a Data Subject to lodge a complaint with the UAE Data Office.

15. Contact us

15.1 The Company has designated a Data Protection Officer responsible for overseeing compliance with this Policy and the PDPL, who may be contacted at privacy@freightmycar.com.