Privacy policy

Who is responsible for your data

The controller of your personal data is BRANDNEST S.R.L., Societate cu răspundere limitată (limited liability company), registered office: Str. Corvinilor nr. 5, bl. Corp D, et. III, ap. 8, 440080 Satu Mare, Satu Mare County, Romania, Trade Register no. J2024035337003, VAT/tax ID RO50780530 (“we”, “us”). We operate the website dubaiactivity.com (“Dubai Activity”).

You can contact us about privacy through our contact page (please choose or mention “Privacy” in your message) or by email (a dedicated address will be published here before launch). We have not appointed a data protection officer, as we are not currently required to do so.

What this policy covers

This policy explains how we handle personal data when you visit Dubai Activity, contact us, click links to partners and, when these features are available, create an account, subscribe to our newsletter or write a review. It does not cover the websites of our partners or operators: when you book with them, they are the controllers of your booking data and their own privacy policies apply.

What data we process, why, and on what legal basis

The legal bases below refer to Article 6(1) of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

Visiting the website

To deliver pages and protect the website against abuse, our servers and our hosting and security providers process technical data such as your IP address, browser type, the page requested and the time of the request. Our application does not store your IP address in plain form: for rate limiting (for example, limiting how many messages can be sent in an hour) we use a hashed value that cannot readily be linked back to you. Technical error and security logs are kept for up to 90 days.

Legal basis: our legitimate interest in running a secure and working website (Article 6(1)(f)).

Contact form

When you write to us through the contact form, we process the details you enter (typically your name, email address and message) to read and answer your request. Messages are stored in our database on our own server. Email sending from the website is not active yet, so we will reply using the contact details you provide.

Legal basis: taking steps at your request or our legitimate interest in answering enquiries (Article 6(1)(b) or (f)); where your message is a complaint or a data protection request, compliance with our legal obligations (Article 6(1)(c)).

Clicks on partner links

Links to partners pass through short addresses on our own domain that start with /go/. When you click one, we record: which link was clicked, the page and position on the page, your device type (mobile, tablet or desktop), your country as reported by our content delivery network, the time, and a random click identifier. We pass that random identifier to the partner so we can match commissions to clicks. We do not record your IP address, name or email address for this purpose.

Legal basis: our legitimate interest in measuring which content is useful and in receiving the commissions that fund the website (Article 6(1)(f)). Click records are kept for 25 months.

Your cookie choices

When you make a choice in our cookie banner, we store it in the da_consent cookie and keep a record on our server as proof: a random consent identifier, the categories you accepted or refused, the policy version, a hashed version of your browser’s user-agent string and the date. See our cookie policy.

Legal basis: compliance with our legal obligation to be able to demonstrate consent (Article 6(1)(c) and Article 7(1)).

Account

If you create an account, we process your name, email address, a securely hashed password, the version of the terms and privacy policy you accepted, your language and currency preferences, your saved favourites and, if you turn it on, two-factor authentication data, plus the date of your last login. To protect accounts we also keep a record of sign-in attempts (a one-way hash of the email address and of the IP address, the result and the time).

If you tick the optional box to receive travel ideas and offers by email, we record that choice and when you made it; you can change it at any time in your account. Your sign-in is kept in a session cookie and, only if you choose “Keep me signed in”, in a second cookie that lasts 30 days (see the cookie policy).

Legal basis: performing our agreement with you under the terms of use (Article 6(1)(b)). Accounts inactive for 3 years are deleted, after we warn you in advance.

Newsletter (when available)

If you subscribe, we process your email address, the exact consent text you agreed to (with its version), the date and the form you used. You must confirm your subscription through a link we send you (double opt-in). Every newsletter contains a one-click unsubscribe link. Subscriptions that are not confirmed are deleted after 30 days.

Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.

Reviews (when available)

If you write a review, we process your rating, text, the date of your visit and the display name linked to your account. Reviews are published under our review and content policy.

Legal basis: performing our agreement with you (Article 6(1)(b)) and our legitimate interest in publishing genuine traveller feedback (Article 6(1)(f)).

Data stored only in your browser

If you are not signed in, your wishlist and your preferred display currency are stored in your browser’s local storage (da_wishlist and da_currency). They are not sent to our server with your requests. When the wishlist page needs to show your saved items, your browser asks our server for those listings by their identifiers only. You can delete this data at any time by clearing your browser’s site data.

Analytics

We do not currently use any analytics service. We plan to add privacy-friendly, self-hosted statistics that do not use cookies and do not identify you. We will update this policy before we start, and ask for your consent first if the law requires it.

Retention periods for contact messages and consent records will be published here before launch. We keep contact messages only as long as needed to handle your request and any follow-up, and consent records as long as needed to demonstrate consent.

No selling of data, no profiling

We do not sell your personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not build advertising profiles about you.

Who receives your data

We share personal data only as far as necessary, with:

• Hosting provider: stores the website and its database on our behalf.
• Content delivery and security provider: delivers pages quickly and protects the website against attacks. It processes technical data such as IP addresses.
• Email service provider (once email sending is enabled): sends confirmation, account and newsletter emails on our behalf.
• Affiliate partners, such as activity booking platforms (for example GetYourGuide or Viator, once we join their programmes): they receive the random click identifier described above. When you continue to their website, they collect data directly from you as independent controllers under their own privacy policies.
• Authorities, courts and professional advisers, where required by law or needed to establish, exercise or defend legal claims.

Our service providers act on our instructions under data processing agreements (Article 28 GDPR). We will list the providers we use by name here before launch, and the list of partners will be completed as we join their programmes.

Transfers outside the European Economic Area

Some providers or partners may be located, or use sub-processors, outside the European Economic Area (EEA), for example in the United States. Where your data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or on the European Commission’s Standard Contractual Clauses together with any additional measures needed. You can ask us for information about the safeguards used through our contact page.

How long we keep data

After these periods, data is deleted or anonymised automatically. We may keep data longer where the law requires it or where it is needed for a legal claim.

Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data deleted in the cases provided by law (Article 17). You can delete your account yourself (Account → Privacy); your favourites and preferences are deleted and your published reviews are anonymised;
• restrict processing in certain cases (Article 18);
• receive your data in a portable format (data portability, Article 20). Signed-in users can download their data as a file from their account (Account → Privacy);
• object at any time to processing based on our legitimate interests (Article 21);
• withdraw your consent at any time, without affecting processing carried out before withdrawal. For cookies, use the cookie settings; for the newsletter, use the unsubscribe link in any email.

To exercise your rights, write to us through our contact page. We answer within one month, which may be extended by two further months for complex requests, in which case we will tell you why. We may ask you to confirm your identity.

Right to complain to a supervisory authority

If you believe we are not handling your data lawfully, you can complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), at the ANSPDCP website, or to the data protection authority in the EU country where you live or work. We would appreciate the chance to address your concern first.

Users in the United Arab Emirates

If you are in the United Arab Emirates, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) may also apply to how your data is processed. It gives you rights similar to those described above, such as the right to obtain information about the processing, to request correction or erasure, to restrict or stop processing and to object. You can exercise them in the same way, through our contact page.

How we protect your data

We use encrypted connections (HTTPS) on the whole website, store passwords only as strong one-way hashes, encrypt two-factor authentication secrets, limit access to our systems to the people who need it and keep software up to date. No system is completely secure; if a personal data breach is likely to put you at high risk, we will inform you as required by law.

Children

Dubai Activity is intended for adults planning travel. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, please contact us and we will delete it.

Changes to this policy

Each version of this policy has a version number and an effective date, shown on this page. We will update it when we add features (for example accounts, the newsletter or analytics) or change providers. If a change significantly affects how we use your data, we will tell registered users in advance and ask for consent again where required.