Privacy and Personal Data Protection Notice

UAE Grand Tour is a travel brand operated from Ibn Battuta Gate Office Complex, Office 114, Jebel Ali, Dubai, United Arab Emirates. Correspondence about personal data should be addressed to info@rocketdmc.com or +971 4 341 7045.

We are responsible for the information described in this notice. Where a hotel, an airline or an experience provider then uses your information for their own purposes, that use is theirs and is governed by their own terms.

Nothing on this site asks for a document number until a document is actually required. This is what we hold at each stage.

• When you enquire or plan a journey: your name, email address, telephone number, the composition of your party, your dates, and any preference or message you write to us.
• When you confirm a booking: the traveller details the providers require, which are the full name, date of birth, nationality, home address and passport details of each traveller, together with your booking reference, your itinerary and the amount paid.
• When you buy a flight: the name, date of birth and the gender recorded in each passenger's travel document, because no airline will issue a ticket without them. Where the airline's own rules require it, the travel document number is collected as well.
• When you pay: your card details are typed into our payment processor's own form and never reach our servers. We receive the outcome, the amount, a payment reference and the partial card record the processor returns to us.
• When you create an account: your email address, and your password stored only as a scrypt hash, which cannot be turned back into the password.
• As you use the site: your IP address and browser, used to limit repeated sign-in and checkout attempts and kept in server logs. If you use the assistant on the site, your message is stored with the conversation, along with the address it came from.
• Only if you agree: the analytics and advertising cookies described below. Nothing optional is loaded until you switch it on.

• To do what you asked us to do: quote, reserve, ticket and operate your journey, and reach you about it. Without this information there is no booking.
• To meet obligations we cannot decline: accounting and tax records, and the passenger information that airlines, security screening and immigration authorities require by law.
• To protect the booking and the site: identifying fraudulent payments and chargebacks, and limiting automated attacks on the sign-in form.
• Because you agreed: analytics and advertising measurement. You can withdraw that at any time, and withdrawing it changes nothing about a booking.

The site sets a small number of cookies it cannot work without: ugt_site_gate for site access, ugt_member_session and ugt_admin_session to keep you signed in, NEXT_LOCALE for your chosen language, and ugt_consent to remember this decision. None of them follows you anywhere.

Analytics and advertising are separate, and off until you switch them on. Refusing does not hide a script that already ran: no tracking script is sent to your browser at all, and where an analytics tool is configured, its consent state is set to denied before its tag is allowed to load. The cookie panel names each tool in use, and says plainly when none is.

Your decision is kept for 180 days, after which we ask again. You can change it at any time through Cookie settings at the foot of every page.

Only those who need it to deliver what you booked, and only the part of it they need.

• The hotels, transport companies, guides and experience providers named in your itinerary.
• The reservation platform our tour operations run on, which holds the itinerary and the traveller details attached to it.
• Our airline ticketing partner and the airline itself when a flight is bought, including the passenger data required for ticketing, security screening and immigration.
• Our payment processor, to take the payment and to handle any refund or dispute.
• The provider that delivers our email, and the provider behind the assistant on the site.
• Our hosting and technical providers, under contract, and only to the extent needed to run the site.
• Government authorities, courts and regulators, where the law requires it.

We do not sell personal data, and we do not pass it to anyone for their own advertising.

We are based in the United Arab Emirates and your information is held here. Delivering a journey means sending what is necessary to airlines, hotels and providers who may be in other countries, including your own. Where the choice of provider is ours, we require them by contract to protect the information and to use it only for the booking.

• Booking, payment and accounting records: five years from the end of the financial year in which the journey took place, because records of this kind must be retained under United Arab Emirates law.
• Enquiries that did not become a booking: twenty-four months, and then deleted.
• Your account: until you ask us to close it. Closing an account does not erase a booking record we are required to keep.
• Assistant conversations and server logs: twelve months.
• Your cookie decision: one hundred and eighty days.

At any time you can ask us to:

• tell you what we hold about you and give you a copy of it;
• correct anything that is wrong;
• delete what we are not required to keep;
• stop or narrow a particular use;
• withdraw a consent you gave, including analytics and advertising;
• hand back the information you gave us in a portable form.

Write to info@rocketdmc.com. We answer within thirty days. We may first ask you to confirm who you are, because handing your information to someone who is not you would be the greater failure.

If our answer does not satisfy you, you may complain to the competent authority: in the United Arab Emirates that is the UAE Data Office, and if you are in the European Union or the United Kingdom it is your local supervisory authority.

The site is not intended to be used by children on their own, and we do not knowingly collect a child's information other than as part of a family booking made by an adult. Where a child travels, the lead traveller provides their details and confirms they are entitled to do so.

The site is served only over an encrypted connection. Card details are entered into our payment processor's own form and never touch our systems. Passwords are stored as scrypt hashes. Administrative access is restricted and separately authenticated.

No system is perfect. If a breach ever affects your information, we will tell you and the authorities as the law requires, rather than wait to be asked.

We may amend this notice. An amendment takes effect when it is published here, and the date above changes with it. Where a change materially affects how we use your information, we will say so rather than leave you to notice.

UAE Grand Tour, Ibn Battuta Gate Office Complex, Office 114, Jebel Ali, Dubai, United Arab Emirates.

info@rocketdmc.com and +971 4 341 7045