Privacy Policy

Depending on how you use the service, we may collect:

• Identity and contact data: name, email, WhatsApp or phone number, preferred communication channel and account identifiers.

• Booking data: tour, date, guest counts and age categories, transport choice, vehicle allocation, add-ons, pickup details, booking reference and status.

• Suitability information: accessibility, health or participation information you choose to share so the booking team can discuss safe options. Do not send more medical detail than is necessary.

• Payment records: AED amount, payment status, payment-provider reference, refund state and receipt information. We do not receive or store your complete card number.

• Account and security data: sign-in events, one-time-code workflow, session information, audit records and signals used to prevent misuse.

• Communications: enquiries, booking messages, support emails, chat messages and any review or media permission you provide.

• Technical data: IP address, browser or device details, page and event information, error logs and security diagnostics when the relevant service is enabled.

Most information comes directly from you when you compare a tour, create a quote, make or manage a booking, sign in, chat, submit a form or contact the team. A person booking for a group may also provide limited information about other guests and must be authorised to do so.

We also receive service events from payment, hosting, database, authentication, email, messaging, analytics and security providers. Operating staff or authorised partners may add fulfilment details such as pickup status or trip notes.

The website uses essential storage where needed to keep an authenticated account secure, return a guest from payment to the correct booking, remember a short-lived booking state and protect service integrity. The group-booking planner may use session storage for the non-personal trip draft; contact details are not kept in that browser draft.

Google Analytics stays off until you choose “Accept analytics” in the cookie banner. If you accept, it sets cookies to count visits and bookings; for a completed booking it can receive the booking value and tour, never your name or contact details. You can change your choice at any time with “Cookie settings” in the footer, and declining deletes the Analytics cookies.

You can clear browser storage through your browser. Blocking essential cookies can prevent account, booking-management or payment-return features from working correctly.

We use personal data only for stated and compatible purposes, including:

• preparing a quote, forming and performing a booking contract;

• checking availability, capacity, price, pickup and activity eligibility;

• taking payment, preventing duplicate charges, issuing receipts and processing refunds;

• sending confirmations, pickup requests, service changes and time-sensitive support;

• providing accounts, secure booking management and live chat;

• responding to enquiries, complaints, privacy requests and legal claims;

• protecting guests, staff, systems and the booking service from abuse or fraud;

• meeting accounting, audit, consumer-protection and other legal obligations; and

• measuring and improving the website when the relevant analytics setting and legal basis allow it.

Depending on the activity, processing may be necessary to take steps you request, perform a contract, comply with law, protect legitimate operational or security interests, protect a person’s vital interests, or act on clear consent.

We share only what each company needs to do its job:

• Supabase: our database, sign-in, live chat and file storage;

• Netlify: hosts and serves the website;

• Stripe and SimpleBit: our payment partners, which take card, Apple Pay and Google Pay payments; a refund goes back through the one you paid with;

• Google: Maps to find your pickup point, reCAPTCHA to block spam on our forms, chat, sign-in and checkout, and Analytics only if you accept it;

• Resend: our email service, used when we email you about a booking or enquiry;

• WhatsApp and Telegram: only when you message us on WhatsApp, or connect Telegram to your booking with a link we send you; and

• authorised drivers, guides, venues and partners, including the buggy and quad riding base at Lahbab and the overnight retreat in Sharjah, that need limited booking or pickup information to deliver the confirmed service.

We may also disclose information where required by law, a competent authority or a valid legal process, or where necessary to establish, exercise or defend legal rights. We do not sell guest contact lists.

Stripe or SimpleBit, whichever you pay with, collects the card or wallet details entered in its payment interface and applies its own privacy and security controls. Dubai Desert King receives the information needed to reconcile the transaction, such as the provider reference, status, AED amount and limited payment-method details supplied by that provider.

Never send card numbers, security codes or wallet credentials through chat, email, WhatsApp or a contact form.

Some technology and communication providers operate infrastructure outside the UAE. This can result in personal data being processed in another country. Where UAE data-protection rules apply, we use an available lawful transfer mechanism and appropriate contractual, organisational or technical safeguards.

The protection available in another country may differ from the UAE. You may contact us for information about the transfer safeguards relevant to your data.

We keep personal data only for as long as it is needed for the booking, customer service, safety, accounting, dispute, fraud-prevention and legal purposes for which it was collected. Different records have different retention periods; live chat messages, for example, are anonymised 12 months after the chat starts. A record may be retained longer where a law, payment dispute, complaint, audit or legal claim requires it.

We use access controls, encryption in transit, separated permissions, audit records, secret management and other proportionate technical and organisational measures. No online system can promise absolute security. If a breach creates a relevant risk, we will follow applicable investigation and notification duties.

Booking confirmations, payment notices, pickup requests, security messages and material trip changes are service communications. They may continue while needed to perform or protect a booking.

Promotional messages are separate. Where consent or an opt-in is required, you may withdraw it through the message route or by contacting us. Opting out of marketing does not remove necessary booking messages or records we must retain.

Subject to applicable law and any permitted exceptions, you may ask for information about processing; request access or a portable copy; correct incomplete or inaccurate data; request erasure; restrict or object to processing; withdraw consent; or ask for human review of a qualifying automated decision.

Send a request through the Contact page or the privacy email above. Describe the request and the booking or account it relates to. We may need to verify identity before releasing or changing personal data. Withdrawing consent does not make earlier lawful processing invalid.

You may also raise a concern with the competent UAE data-protection authority where that right applies.

Bookings are made by an adult. Information about a child should be supplied only by a parent, guardian or authorised group organiser and only to the extent needed for pricing, capacity, suitability and safe delivery.

The website may link to third-party services with their own privacy notices. Review those notices before sending information outside Dubai Desert King.

We may update this policy when technology, providers, law or operating practices change. The current version and update date will remain published on this page.

Google Maps helps you search for a hotel, select an entrance pin and check a pickup address. Opening a map connects your browser to Google. We send the address, place identifier or pin you choose to Google for address verification. Your device location is requested only when you choose “Use my current location” and allow the browser’s location prompt.

The confirmed pickup and optional return location, entrance instructions and verification record are kept with your booking for collection and support. We do not use those booking locations as a shared address-search cache. Google processes map-service data under its Privacy Policy. You can enter an address draft without granting device-location access.