Privacy Policy

1.Introduction and Scope

This Privacy Policy explains how Pinas Travel ("we", "us", "our") collects, uses, stores, shares and protects personal data when you visit pinastravel.com, send us an enquiry, make a booking by phone, WhatsApp, email or at our counter, apply for a visa through us, create an account, subscribe to our updates, or otherwise deal with us.

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, once in force, its Executive Regulations, together with other applicable UAE laws including the Consumer Protection Law, Federal Decree-Law No. 14 of 2023 on Trading through Modern Technology, and UAE tax legislation.

This Policy applies to customers, travellers named on a booking, visa applicants and their sponsors, website visitors, newsletter subscribers, and people who contact us. It does not apply to the websites or services of airlines, hotels, payment gateways or other third parties, which have their own privacy policies.

2.Who Is Responsible for Your Data

Pinas Travel, of Reef Mall Level 1 Shop 12, Deira, Dubai, UAE, is the controller of the personal data described in this Policy. This means we decide why and how your data is processed and are responsible for protecting it.

For any privacy question or request, contact our privacy team at info@pinastravel.com (please put "Privacy" in the subject line), call 04 883 0858, or write to us at the address above.

3.Personal Data We Collect

Depending on how you use our Services, we may collect the following categories of personal data about you and about anyone travelling with you:

• Identity data: full name as shown on the passport, title, gender, date and place of birth, nationality, and photograph.
• Contact data: phone and WhatsApp number, email address, residential address, and emergency contact details.
• Travel document data: passport number, issue and expiry dates, issuing country, copies of passport pages, UAE residence visa and Emirates ID details, and previous visas.
• Visa application data: the information and supporting documents a consulate or immigration authority requires, which may include employment letters, salary certificates, bank statements, tenancy contracts, invitation letters, travel history, marital status and family relationships, and sponsor details.
• Booking data: itineraries, flight and hotel bookings, ticket numbers, seat and meal preferences, frequent-flyer numbers, special assistance requests, insurance policies, and booking history.
• Financial data: payment amounts, method, date and status; bank account details for refunds; and the last four digits of payment cards. Full card numbers are handled by our payment gateway and are not stored by us.
• Account data: login email, encrypted password, saved trips and preferences, if you create an account.
• Communications: enquiries, messages and emails you send us, including through our website forms and WhatsApp, and notes of telephone conversations about your booking.
• Marketing preferences: whether you have agreed to receive updates and offers from us, and how you would like to receive them.
• Technical data: IP address, device and browser type, pages visited and the date and time of your visit, collected through essential cookies and local storage (see our Cookies Policy).

4.Sensitive Personal Data

Some information you share with us is sensitive personal data under the PDPL — for example, health information (such as a medical condition, disability, pregnancy or mobility need relevant to travel), religious information (such as an Umrah or Hajj booking), family relationships disclosed for a visa, and biometric photographs.

We process sensitive personal data only where it is necessary to provide the service you have asked for (for example, telling an airline you need wheelchair assistance, or submitting a visa application), where you have given explicit consent, or where the law otherwise permits it. We restrict access to it to the staff who need it and share it only with the Supplier or authority concerned.

5.How We Collect Your Data

• Directly from you, when you complete a form on our website, message or call us, visit our counter, or send us documents.
• From the lead traveller or booker, who may give us details of other travellers, a family member, a visa sponsor or an employer. If you give us someone else's data, you must have their permission and make this Policy available to them.
• From your employer or travel manager, for corporate bookings.
• From Suppliers and authorities, for example airlines notifying schedule changes, hotels confirming reservations, consulates issuing visa decisions, and payment gateways confirming payments.
• Automatically, through essential cookies and local storage when you use our website.

6.Why We Use Your Data and Our Legal Basis

We only process personal data where the PDPL allows us to. Depending on the activity, we rely on the following:

• To respond to enquiries, prepare quotations and arrange bookings — necessary to take steps at your request before entering into a contract, and to perform the contract with you.
• To issue tickets, vouchers and reservations, manage changes, cancellations and refunds, and provide support before and during travel — performance of a contract.
• To prepare and submit visa applications and book visa appointments on your instruction — performance of a contract and, for sensitive data, your explicit consent.
• To pass on special assistance, medical or dietary requests to Suppliers — your explicit consent.
• To process payments, prevent fraud and verify identity, including checks required under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering — legal obligation and legitimate interests.
• To keep accounting and tax records, including VAT records under Federal Decree-Law No. 8 of 2017 and UAE tax procedures legislation — legal obligation.
• To handle complaints and legal claims and to respond to lawful requests from UAE authorities — legal obligation and legitimate interests.
• To send you newsletters, offers and travel updates — your consent, which you may withdraw at any time.
• To keep our website secure and working, and to improve our services — legitimate interests, using essential cookies only unless you consent to others.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

7.Who We Share Your Data With

We do not sell your personal data. We share it only where necessary for the purposes above, with:

• Airlines, hotels, insurers, tour operators, transport and car rental companies, and airport service providers, to make and manage the bookings you request.
• Global distribution systems and reservation platforms that hold airline and hotel booking records.
• Embassies, consulates, visa application centres and immigration authorities (including UAE federal and Emirate-level immigration authorities), when you instruct us to apply for a visa.
• Payment gateways and banks, to process payments and refunds.
• Technology providers who host our website and databases, provide email and messaging services, and support our systems, under contracts requiring them to protect your data and use it only on our instructions.
• Professional advisers such as auditors and lawyers, under duties of confidentiality.
• Government, regulatory, tax and law-enforcement authorities, where we are required to by UAE law or a court order.
• A buyer or successor of our business, if it is sold or reorganised, under the same privacy commitments.

Airlines and some destination governments require passenger information (such as Advance Passenger Information) before travel. We provide it to the airline as part of your booking; the airline and the destination authority then process it under their own legal obligations.

8.International Transfers

Travel is international by nature. When you book a flight, hotel, tour or visa outside the UAE, we necessarily transfer your personal data to the Supplier or authority in that country, which may not have data protection laws equivalent to the UAE's. These transfers are necessary to perform the contract you have asked us to carry out, which the PDPL permits.

Where we use service providers outside the UAE for hosting, email or other support, we transfer data only to countries with adequate protection or under contractual safeguards that require the recipient to protect your data to the standard required by the PDPL.

9.How Long We Keep Your Data

We keep personal data only for as long as necessary for the purpose it was collected for, and to meet legal requirements. As a guide:

• Booking, invoice and payment records: at least five years after the end of the tax period concerned, as required by UAE tax legislation, and longer if needed for an ongoing claim or audit.
• Copies of passports and visa supporting documents: for the duration of the application and up to 90 days after the visa decision or your travel date, unless you ask us to keep them for a future application or the law requires longer retention.
• Enquiries that do not lead to a booking: up to 24 months, so we can follow up and assist with your plans.
• Account data: while your account is open, and up to 12 months after closure unless required longer for the booking records above.
• Marketing preferences: until you withdraw consent, after which we keep a record of the opt-out so that we do not contact you again.
• Complaint records: up to five years after the complaint is closed.

When data is no longer needed, we securely delete it or anonymise it so that it can no longer identify you.

10.How We Protect Your Data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) on our website, encryption of passwords, PCI-DSS compliant payment gateways, role-based access to booking and document systems, audit logs, secure disposal of paper documents, and confidentiality obligations for all staff.

Passport and visa documents are accessed only by the consultants handling your application. Please send documents through the channels your consultant provides and avoid sending them to unverified numbers or addresses.

No system is completely secure. If a personal data breach occurs that is likely to affect your privacy or rights, we will notify the UAE Data Office and you as required by the PDPL, and tell you what we are doing about it and what you can do to protect yourself.

11.Your Rights

Subject to the conditions and exceptions in the PDPL, you have the right to:

• Obtain information about how we process your personal data, and receive a copy of the personal data we hold about you.
• Have inaccurate or incomplete personal data corrected.
• Have your personal data erased where it is no longer necessary for the purpose it was collected for, where you withdraw consent and no other legal basis applies, or where it has been processed unlawfully.
• Restrict processing while the accuracy of data or the lawfulness of processing is being checked, or where you need the data kept for a legal claim.
• Object to processing based on our legitimate interests, and to processing for direct marketing at any time.
• Receive personal data you provided to us in a structured, machine-readable format and have it transmitted to another controller, where technically feasible.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint with the UAE Data Office.

Some rights are limited by law — for example, we cannot delete booking and invoice records we are required to keep for tax purposes, and we cannot recall data already passed to an airline or consulate for a booking or application you asked us to make, though we will tell them of a correction where needed.

12.How to Exercise Your Rights

Send your request to info@pinastravel.com with "Privacy request" in the subject, or ask at our counter. Tell us which right you wish to exercise and give enough detail for us to find your records (for example, your name, phone number and booking reference).

To protect your data, we will verify your identity before acting on a request, and may ask for additional information. If you make a request on someone else's behalf, we will need evidence of your authority.

We will respond without undue delay and within the period required by the PDPL, normally within 30 days. If a request is complex, we will tell you if we need more time and why. We do not charge for requests unless they are manifestly unfounded or excessive, in which case we will tell you the fee in advance or explain why we are declining.

13.Marketing

We send newsletters, seasonal offers, fare alerts and visa updates by email, SMS or WhatsApp only if you have opted in — for example, by ticking the box on an enquiry form or subscribing to our newsletter.

Every marketing email contains an unsubscribe link, and you can reply "STOP" to any marketing SMS or WhatsApp message, or contact us. We will stop within 7 days. You will still receive service messages about bookings you have made.

14.Cookies and Local Storage

Our website uses a small number of essential cookies and browser storage to keep you signed in, remember your trip selections and record your cookie choice. We do not currently use advertising or analytics cookies. Full details, including the name, purpose and duration of each, are in our Cookies Policy.

15.Children's Data

Our Services are intended for adults. We do not knowingly accept bookings or enquiries directly from children under 18.

Bookings and visa applications often include children as travellers. In that case we collect the child's data from their parent or legal guardian, who must have authority to provide it, and we use it only to provide the travel services and applications requested.

16.WhatsApp and Social Media

If you contact us through WhatsApp or social media, the platform operator (for example, Meta) processes your messages under its own privacy policy, in addition to our processing under this Policy. Please avoid sending passport or financial documents through social media direct messages; your consultant will tell you the secure channel to use.

17.Third-Party Websites

Our website links to third-party websites and embeds services such as Google Maps and payment gateways. We are not responsible for their privacy practices. Please read their policies before giving them personal data.

18.Changes to This Policy

We may update this Policy to reflect changes in our services, our Suppliers or UAE law, including the Executive Regulations of the PDPL. The effective date at the top of this page shows when it was last revised. If we make a significant change, we will tell you by email or a notice on our website before it takes effect.

19.Complaints and Contact

If you have a concern about how we handle your personal data, please contact us first at info@pinastravel.com, call 04 883 0858, or write to Pinas Travel, Reef Mall Level 1 Shop 12, Deira, Dubai, UAE. We will acknowledge your concern within 1 Business Day and try to resolve it promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office established under Federal Decree-Law No. 44 of 2021.