DuneTribe4x4
Back to homePrivacy policy
Last updated: 2 October 2026
This policy explains how we handle your personal data when you visit dunetribe4x4.com, send a booking request, join our waitlist, contact us or rent a car from us. We do not sell your data. Our website has no analytics, advertising, tracking pixels or social plugins.
Who is responsible for your data
The controller of your personal data is:
- Dune Tribe Rent a Car LLC (رفاق الكثبان لتأجير السيارات ش.م.م), a limited liability company of the Sultanate of Oman, Commercial Registration No. 1679332
- Registered office: Al Khawd, Al Seeb, Muscat Governorate, Sultanate of Oman. P.O. Box 123, Postal Code 124
- Email: info@dunetribe4x4.com">info@dunetribe4x4.com · WhatsApp: +968 7673 3227 · Phone: +968 7673 3227
We have not appointed a data protection officer, a representative in the European Union or a representative in the United Kingdom. For any privacy question, contact us directly.
What data we collect
Booking request form. We receive:
- your full name, email address and WhatsApp or phone number;
- your message, if you write one (optional);
- the car model, pick-up and return dates and times, and number of cars;
- the pick-up and return place: the airport, or a hotel or address in Muscat. If you place a pin on the map, we also receive its coordinates, as a Google Maps link;
- the estimated total, the reference number (for example DT-26-1234), the language and address of the page you used, and the fact that you ticked the privacy box.
With each request we also store your IP address, your browser's user-agent string (the browser and device type it reports) and the time you sent it. We use the IP address and user-agent to prevent spam and abuse, and the time to know when you sent your request.
Waitlist form. It appears only when bookings are closed and is not active now. It collects your email address, preferred travel months, number of travellers and your consent.
Messages. If you email us or write to us on WhatsApp, we receive your message and the contact details that come with it.
The map. The map loads only if you open it (see Who receives your data). Your browser shares your location only if you tap "Use my location" and allow it.
A normal visit. Pages load from our hosting provider, Amazon Web Services (AWS). To send you the pages, AWS receives your IP address and the technical data your browser sends (for example the browser type and language). Access logs (Amazon CloudFront) are switched off, so we keep no record of your visit. Fonts and scripts come from our own website, not from outside services. So a normal visit sends nothing to any company other than AWS.
If you rent a car. At pick-up you show your national driving licence and passport. Drivers from some countries also need an International Driving Permit. Whether we keep copies of these documents, and any other data we collect during the rental, is set out in your booking confirmation and in the rental agreement you sign at pick-up. We keep the rental agreement, invoices and payment records.
The website takes no payments. Our reply to your request tells you how to pay the deposit (the 30% advance payment that confirms your booking). The security deposit is something different: a hold on your card at pick-up, not a payment. Its amount is set out in your booking confirmation and in the rental agreement you sign at pick-up.
Why we use your data and the legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Show you our website | IP address, browser technical data (not stored by us) | Legitimate interest in running our website (Art. 6(1)(f)) |
| Check availability, reply with the final price and how to pay the deposit | Booking request, messages | Steps you ask for before a contract (Art. 6(1)(b)) |
| Run your rental | Booking data, licence, passport, payment records | Contract (Art. 6(1)(b)) |
| Insure the car, handle claims, take payments, answer Omani authorities | Rental and payment records, licence, passport | Contract (Art. 6(1)(b)); legitimate interest in meeting our duties under Omani law and in making or defending legal claims (Art. 6(1)(f)) |
| Keep rental agreements, invoices and payment records | Rental and payment records | Legitimate interest in following Omani tax and commercial law (Art. 6(1)(f)), see note |
| Prevent spam and abuse | IP address, user-agent, time | Legitimate interest in keeping our website and inbox safe (Art. 6(1)(f)) |
| Keep the form service working and find errors | Technical logs (no form contents) | Legitimate interest in a working and secure website (Art. 6(1)(f)) |
| Answer questions not about a booking | Messages, contact details | Legitimate interest in answering people who contact us (Art. 6(1)(f)) |
| Show the map and find places | IP address, search text or coordinates | Legitimate interest in helping you choose a pick-up or return place (Art. 6(1)(f)) |
| Use your location on the map | Device location | Consent, given in your browser (Art. 6(1)(a)) |
| Tell you when bookings open | Waitlist form | Consent (Art. 6(1)(a)) |
Note. Omani tax and commercial law requires us to keep these records. The GDPR does not treat a duty under a law from outside the EU as a legal obligation. So, under the GDPR, we rely on our legitimate interest in following Omani law (Art. 6(1)(f)).
The tick box. Before you send a form, you tick a box. On the waitlist form, the tick is your consent to get an email when bookings open. On the booking request form, the tick is not our legal basis under the GDPR. Our legal bases are in the table above. Where the Oman Personal Data Protection Law requires your explicit consent, the tick is your consent to use your data as this policy describes, to answer your request. You can withdraw it at any time by writing to info@dunetribe4x4.com">info@dunetribe4x4.com. We then stop handling your request, but we keep the records the law requires. This policy gives you information. It is not part of your rental contract.
Do you have to give us your data?
You do not have to send us a booking request. If you do, we need your name, email, phone or WhatsApp number and trip details to answer it. The message, the map pin and your location are optional. On the waitlist form, we need your email address to tell you when bookings open.
To rent a car, you must show your national driving licence and passport. Drivers from some countries also need an International Driving Permit. Without these documents we cannot hand over the car.
Who receives your data
- Amazon Web Services (AWS): hosts the website (Amazon S3, CloudFront), processes the forms (AWS Lambda), stores requests (Amazon DynamoDB) and sends us notifications (Amazon SNS). Region: US East (N. Virginia), USA.
- Amazon WorkMail (AWS, US East): handles emails to info@dunetribe4x4.com.
- Microsoft (Outlook.com): each booking request is emailed, through Amazon SNS, to our company mailbox, which is a Microsoft Outlook.com mailbox. Microsoft provides this mailbox under its own terms and privacy statement.
- OpenStreetMap Foundation (United Kingdom), only if you open the map: its tile servers show the map and its Nominatim service searches addresses. It receives your IP address and your search text or coordinates, and uses them under its own privacy policy.
- WhatsApp (Meta), only if you write to us there. WhatsApp's own terms and privacy policy apply.
- Google Maps: our website sends nothing to Google. If you place a pin, it reaches us as a Google Maps link that contains only the coordinates. When we open the link, Google receives those coordinates, but not your name or contact details.
- Instagram (Meta): our Instagram link is a plain link, not a plugin. Instagram receives nothing from our website unless you click it.
- Our insurer, only if you rent a car and only when needed, for example to handle a claim. The name of the insurer is set out in your booking confirmation and in the rental agreement you sign at pick-up.
- Banks and payment providers, only if you rent a car: they handle the deposit, the balance and the security deposit hold. How you pay is set out in your booking confirmation and in the rental agreement you sign at pick-up.
- Public authorities in Oman (such as the police, courts or tax authorities), accountants and lawyers: only when Omani law requires it, for our tax and accounting duties, or to make or defend a legal claim.
International transfers
We are based in Oman. We use your data from Oman, under Omani law and, where it applies, under the GDPR. The European Commission has not adopted an adequacy decision for Oman (a decision that a country protects personal data to the EU standard).
Some of the companies listed above handle your data outside Oman and the EU/EEA:
- USA: AWS and Microsoft, both certified under the EU-US Data Privacy Framework, which the European Commission recognises as adequate.
- United Kingdom: the OpenStreetMap Foundation. The EU has an adequacy decision for the United Kingdom.
Our safeguards are described under Security. To ask about them, write to info@dunetribe4x4.com">info@dunetribe4x4.com.
How long we keep your data
| Data | How long |
|---|---|
| Booking requests (with the IP address, user-agent and time stored with them) and waitlist entries | Deleted automatically 12 months after you sent them |
| Booking notification emails in our mailbox | Deleted when no longer needed, at the latest 12 months after the request. If a rental followed, the period is set out in your booking confirmation and in the rental agreement you sign at pick-up |
| Rental agreement, invoices, payment records | As long as Omani tax and commercial law requires |
| Driving licence and passport details | Set out in your booking confirmation and in the rental agreement you sign at pick-up |
| Technical logs of the form service (no form contents) | 30 days, deleted automatically |
| Website access logs | None: switched off |
| Emails and WhatsApp messages you send us | As long as we need them to answer you and handle any booking that follows |
Your rights
Under the GDPR and the UK GDPR you have the right to:
- Access: get a copy of your data and information about how we use it.
- Rectification: have wrong or incomplete data corrected.
- Erasure: have your data deleted. We may have to keep records the law requires, for example invoices.
- Restriction: ask us to limit how we use your data.
- Portability: receive the data you gave us in a common, machine-readable format, or have it sent to another company. This applies to data we use under a contract or your consent.
- Withdrawal of consent: at any time, for example to leave the waitlist or to block location access in your browser. Withdrawing does not make our earlier use of your data unlawful.
Your right to object. You can object at any time, for reasons related to your situation, to our use of your data based on legitimate interests. We will then stop, unless we have compelling legitimate reasons that override your interests, or we need the data to make or defend a legal claim.
The Oman Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation (Ministerial Decision 34/2024) also give you rights. They include the right to withdraw your consent, to ask for a copy, correction, transfer or deletion of your data, to be told about a data breach that affects you, and to complain to the MTCIT.
How to use your rights. Email info@dunetribe4x4.com">info@dunetribe4x4.com or write on WhatsApp. It is free. We may ask you to confirm your identity. We only ask for what we need for this. We reply within one month. If a request is complex, or if we receive many requests, the GDPR allows us to take up to two more months. If we need more time, we tell you within the first month.
Complaints
You can contact us first, but you do not have to. You also have the right to complain to a data protection authority:
- EU/EEA: the authority in the country where you live, where you work or where you think the problem happened. List of EU/EEA authorities.
- United Kingdom: the Information Commissioner's Office. Make a complaint to the ICO.
- Oman: the Ministry of Transport, Communications and Information Technology (MTCIT), the authority for the Personal Data Protection Law. mtcit.gov.om.
No automated decisions or profiling
We do not make decisions about you by automated means only, and we do not create profiles. We check every booking request and reply ourselves.
Security
Data you send through our website travels encrypted (HTTPS). Our booking database is also encrypted while the data is stored. The technical logs of our form service contain no form contents and are deleted automatically after 30 days. If a data breach puts your rights at risk, we will tell you and the competent authorities as the law requires.
Children
Our forms do not ask for data about children. Children may travel with you, for example in a child seat. The minimum age and licence requirements for drivers are set by our insurer and confirmed before booking. If you think a child has sent us personal data, contact us at info@dunetribe4x4.com">info@dunetribe4x4.com.
Cookies and browser storage
Our website sets no cookies, and the map tiles we load set none either. If you choose a language, an appearance (Auto, Day or Night) or reduced transparency in the menu, your browser saves that choice on your device (localStorage) until you clear your site data. On your first visit, the website may open in your browser's language. For this it reads your browser's language setting and saves nothing. Details are on our Cookies page.
Changes to this policy
We may update this policy, for example when our providers or the law change. The date at the top shows the latest version. A change never reduces your rights under the law. If we want to use data you already gave us for a new purpose, we will tell you first and, where the law requires, ask for your consent.
Languages
This policy is available in several languages. If a translation is unclear, contact us at info@dunetribe4x4.com">info@dunetribe4x4.com.