Privacy Policy

1. About This Policy

Ultimate Destination Tourism LLC (“we”, “us”, “our”) is a licensed inbound tour operator and Destination Management Company (DMC) registered in the Emirate of Dubai, UAE (DTCM License No. 1017327). We operate at 206 Mohammed Noor Talib Building, 53 Khalid Bin Al Waleed Road, Al Fahidi, Bur Dubai, Dubai, UAE.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our website (ultimatedestinationtourism.com), enquire about or book a tour, or interact with us by any means.

This policy is issued in compliance with:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and its implementing regulations
• The EU General Data Protection Regulation (GDPR) — to the extent we process personal data of individuals located in the European Economic Area (EEA) or the United Kingdom
• UK GDPR (as retained in UK domestic law following Brexit)

If there is a conflict between UAE PDPL requirements and GDPR requirements in respect of the same data subject, we will apply the higher standard of protection.

2. Who We Are (Data Controller)

For the purposes of UAE PDPL and GDPR, Ultimate Destination Tourism LLC is the Data Controller in respect of all personal data processed under this policy.

Contact details for privacy matters:

• Company: Ultimate Destination Tourism LLC
• Address: 206 Mohammed Noor Talib Building, 53 Khalid Bin Al Waleed Road, Al Fahidi, Bur Dubai, Dubai, UAE
• Email: info@udtours.com
• Phone: +971 56 619 1502

For data subjects in the EEA or UK who wish to exercise GDPR or UK GDPR rights, the same contact details apply. We do not currently have a designated EU or UK representative, but will respond to all data subject requests within the timelines prescribed by applicable law.

3. Personal Data We Collect

3.1 Data You Provide Directly

• Full name, nationality, and passport or identity document details (required for tour bookings and visa-related services)
• Contact information: email address, phone number, postal address
• Travel preferences, dietary requirements, and accessibility needs
• Payment information: billing details processed via Network International (we do not store full card numbers)
• Enquiry and correspondence content submitted via forms, email, or WhatsApp
• Feedback and reviews you submit

3.2 Data Collected Automatically

• IP address, browser type, operating system, and device identifiers
• Pages visited, time on site, referral source, and session data (via Google Analytics)
• Ad interaction and conversion data (via Meta Pixel / Facebook Ads)
• Cookie identifiers (see Section 7)

3.3 Data From Third Parties

• Booking and traveller details passed to us by B2B partner travel agencies and wholesalers on your behalf
• Social media interaction data where you engage with our pages or ads

4. Legal Basis for Processing

Under GDPR and UK GDPR, we process your personal data on the following legal bases. UAE PDPL requires a lawful basis for processing equivalent to those listed below.

• Contract performance: To process your booking, arrange your tour itinerary, liaise with suppliers, and fulfil all services you have requested
• Legal obligation: To comply with UAE tourism regulations, DTCM licensing requirements, anti-money laundering obligations, and tax laws
• Legitimate interests: To operate and improve our website, prevent fraud, respond to enquiries, and conduct B2B outreach to travel trade partners — where these interests are not overridden by your rights
• Consent: For marketing communications by email or WhatsApp, and for non-essential cookies (including analytics and advertising cookies). You may withdraw consent at any time without affecting the lawfulness of prior processing

5. How We Use Your Personal Data

• Processing and managing your tour booking and itinerary
• Communicating with you before, during, and after your trip
• Sharing necessary details with hotels, transport operators, activity providers, and guides to fulfil your booking
• Processing payments through Network International
• Sending booking confirmations, vouchers, and travel documentation
• Responding to enquiries and providing customer support
• Sending marketing communications where you have consented or where permitted by applicable law
• Analysing website usage to improve our content and user experience
• Running targeted advertising via Meta Ads and Google Ads platforms
• Complying with legal and regulatory obligations
• Detecting, investigating, and preventing fraud or misuse

6. Who We Share Your Data With

We do not sell your personal data. We share it only where necessary and with appropriate safeguards in place.

6.1 Service Delivery Partners

To fulfil your booking, we share relevant personal data (name, nationality, contact details, special requirements) with:

• Hotels, resorts, and accommodation providers
• Transport and transfer companies
• Tour guides, activity operators, and entry ticket providers
• Airline and cruise operators (where applicable)

These parties receive only the data necessary for the specific service and are not permitted to use it for any other purpose.

6.2 Payment Processing

Card payment data is processed by Network International (www.networkinternational.ae), a UAE-based payment service provider. We do not receive or store your full card number. Network International’s own privacy policy governs their processing.

6.3 Analytics and Advertising Platforms

• Google LLC — Google Analytics (website behaviour data, anonymised where possible)
• Meta Platforms Inc. — Meta Pixel (ad conversion tracking and retargeting)

Both Google and Meta are certified under applicable data transfer frameworks. Their processing is subject to their own privacy policies.

6.4 CRM and Email Marketing

We use a third-party CRM and email marketing platform to manage customer communications and B2B outreach. Data is stored and processed by that platform under a data processing agreement with us. We will update this section with the specific platform name upon deployment.

6.5 Legal and Regulatory Disclosure

We may disclose personal data to UAE government authorities, DTCM, law enforcement, or courts where required by law or to protect our legal rights.

7. Cookies and Tracking Technologies

Our website uses the following categories of cookies:

• Strictly necessary cookies: Required for the website to function. These cannot be disabled.
• Analytics cookies: Set by Google Analytics to measure how visitors use our site. We use this data in aggregate and anonymised form to improve content and navigation.
• Advertising cookies: Set by Meta Pixel to measure ad performance and enable retargeted advertising on Facebook and Instagram.
• Functional cookies: Remember your preferences (e.g. language, currency) to improve your experience.

On your first visit, we request your consent for non-essential cookies via our cookie consent banner. You may withdraw or change your cookie preferences at any time through the cookie settings link in our website footer.

You can also control cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside the UAE, including countries within the EEA, the United States, and other jurisdictions where our service delivery partners and technology providers operate.

Where we transfer personal data from the EEA or UK to countries not deemed adequate by the European Commission or the UK ICO, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) where applicable
• The recipient’s certification under applicable data transfer frameworks

Transfers within the UAE are governed by UAE PDPL requirements regarding cross-border data flows.

9. How Long We Keep Your Data

• Booking and transaction records: 5 years from the date of travel, in accordance with UAE commercial and tax laws
• Passport and identity document copies: Deleted within 90 days of travel completion, unless retention is required by applicable law
• Marketing consent records and communications: Until you withdraw consent, plus 1 year
• Website analytics data: As configured in Google Analytics (default 26 months; we apply data minimisation settings)
• Enquiry data where no booking results: 12 months from last contact

After the applicable retention period, data is securely deleted or irreversibly anonymised.

10. Your Rights

10.1 Rights Under UAE PDPL

As a data subject under UAE PDPL, you have the right to:

• Be informed about how your data is processed
• Access your personal data held by us
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention obligations)
• Object to processing in certain circumstances
• Lodge a complaint with the UAE Data Office

10.2 Additional Rights Under GDPR / UK GDPR

If you are located in the EEA or UK, you additionally have the right to:

• Data portability — receive your data in a structured, machine-readable format
• Restrict processing in certain circumstances
• Withdraw consent at any time (without affecting prior lawful processing)
• Not be subject to solely automated decision-making that produces legal or similarly significant effects
• Lodge a complaint with your national data protection authority (e.g. the UK ICO or your EU supervisory authority)

10.3 How to Exercise Your Rights

Submit a written request to info@udtours.com with the subject line “Data Subject Request”. We will respond within 30 days (GDPR) or the timeframe required by UAE PDPL. We may need to verify your identity before processing your request.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• SSL/TLS encryption for data transmitted via our website
• Access controls limiting data access to authorised personnel only
• Regular security reviews of our website and hosting environment
• Data processing agreements with all third-party processors

No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

12. Children’s Privacy

Our services are not directed at children under the age of 18 acting independently. Where a booking includes minors, personal data relating to those minors is provided by the accompanying adult, who confirms they are authorised to do so. We do not knowingly collect personal data from minors without verifiable parental or guardian consent.

13. Third-Party Websites

Our website may contain links to third-party websites (including hotel booking engines, visa service providers, and attraction ticketing platforms). This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The effective date at the top of this document will be updated accordingly. Where changes are material, we will notify you by email (if we hold your contact details) or by a prominent notice on our website.

Continued use of our website or services after the effective date of any update constitutes acceptance of the revised policy.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact:

Ultimate Destination Tourism LLC

206 Mohammed Noor Talib Building 53 Khalid Bin Al Waleed Road, Al Fahidi Bur Dubai, Dubai, UAE

Email: info@udtours.com

Phone: +971 56 619 1502

Website: ultimatedestinationtourism.com

DTCM License No. 1017327