1. Who we are and scope

This Privacy Policy explains how ANANDA COMMERCIAL BORKER, an Abu Dhabi Trader establishment licensed under Licence No. CN-5366711 and trading as Ananda Hub (“Ananda Hub”, “we”, “us” or “our”), handles personal data when you use our mobile application, anandahub.com, customer support, booking tools, communications and related services (the “Platform”). It applies to Customers, prospective Customers and people who contact us. Partners may separately process your data under their own privacy policies.

For personal data we decide how and why to process, Ananda Hub acts as the controller. For certain Booking information, Ananda Hub and the relevant Partner may each act as independent controllers. Payment providers process payment data under their own terms and privacy policies.

2. Personal data we collect

3. How we collect personal data

• Directly from you when you register, book, pay, upload documents, choose location, contact support, submit a review or set preferences.
• Automatically from the Platform and your device, subject to permissions and settings.
• From Partners when they confirm, change, fulfil or report an issue with a Booking.
• From payment, authentication, analytics, communications, fraud-prevention and technology providers.
• From a person making a Booking for you, provided they are authorized to share your data and inform you of this Policy.

4. Why we use personal data and our legal grounds

Where processing depends on consent, you may withdraw consent at any time without affecting processing already lawfully completed. Some data is necessary to create an account or fulfil a Booking; if you do not provide it, the relevant feature or service may not be available.

5. When we share personal data

• Partners: the relevant vendor, rental company, yacht operator, venue, wellness or professional provider, licensed travel partner, hotel, airline, transfer operator or other supplier, to quote, verify and fulfil your Booking.
• Payment and wallet providers: including Stripe, banks, card networks and Apple Pay where selected, to authorize and process payments, deposits and refunds.
• Technology providers: cloud hosting, authentication, maps/location, analytics, crash reporting, messaging, email, customer-support, cybersecurity and fraud-prevention vendors acting under contractual or legal safeguards.
• Professional advisers and insurers: lawyers, auditors, accountants, consultants and insurers where reasonably necessary and subject to confidentiality.
• Authorities and legal recipients: courts, police, regulators, tax bodies, consumer-protection authorities or other parties where disclosure is legally required or necessary to protect rights, safety and security.
• Corporate transactions: prospective or actual buyers, investors, lenders or restructuring parties under confidentiality and lawful safeguards. We will provide notice where required.

We do not sell or rent personal data. We do not permit Partners to use Booking information for unrelated marketing unless they have their own lawful basis and provide appropriate notice.

6. International data transfers

Personal data may be transferred outside the UAE when necessary for an international travel Booking or when a payment, cloud, communications or technical provider processes data abroad.

Transfers will occur only where permitted under Articles 22 and 23 of the UAE Personal Data Protection Law, including to an approved adequate jurisdiction, under a binding contract requiring UAE-equivalent protection, for contractual necessity, or with express consent where legally appropriate.

We limit transferred data to what is necessary. Destination-country laws may differ from UAE law; you may contact us for available information about the relevant recipient categories and safeguards.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described, including service, accounting, tax, dispute, fraud-prevention and legal obligations. Typical periods are:

We may retain data longer where required by law, legal hold, fraud investigation, safety incident or dispute. When no longer needed, data is deleted, securely destroyed or anonymized.

8. Security

We use reasonable technical and organizational measures designed to protect personal data, such as access controls, authentication, encryption in transit where appropriate, payment-provider tokenization, logging, backups, staff confidentiality and vendor due diligence.

No system is completely secure. You should use a strong unique password, protect your device and notify us of suspected account compromise.

9. Your privacy rights

Subject to the conditions and exceptions under applicable UAE law, you have the following rights:

• receive information about processing and request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion where there is no valid reason to continue processing;
• restrict or object to certain processing, including direct marketing;
• withdraw consent where processing is based on consent;
• request transfer of data in a structured, machine-readable form where applicable;
• object to decisions based solely on automated processing where those decisions have significant legal effects, subject to applicable exceptions; and
• complain to the competent UAE data-protection or consumer authority.

To exercise a right, contact Abdulla@anandaplatform.com, info@anandaplatform.com or use Help & Support.

You may also request account deletion through the available account or support controls. We may verify your identity and ask for information needed to locate the data. We will respond within the period required by applicable law.

Rights may be limited where disclosure would affect another person, legal privilege, fraud prevention, regulatory duties or legal claims.

10. Location, device permissions and notifications

Location, camera/photo library and push-notification access depends on the features you use and the permissions you grant. You can change permissions in device settings.

Disabling a permission may limit nearby search, document upload, media or booking-notification features. Essential service messages may still be sent by email, SMS or in-app channels where needed for a Booking or account security.

11. Cookies and similar technologies

Our website and app may use cookies, software development kits, local storage, pixels and similar technologies for sign-in, security, preferences, analytics, performance and marketing.

Where legally required, non-essential technologies will be used only after consent. You can manage browser cookies and relevant app/device permissions, although essential technologies are required for core functionality.

12. Profiling and recommendations

With your consent, we may use favourites, searches, general location, booking history and interactions to order results or recommend relevant experiences. This does not produce legal or similarly significant effects.

You may withdraw consent or adjust marketing and notification preferences at any time without affecting essential Booking functions.

13. Children

The Platform is intended for adults aged 18 or over for account creation and Bookings. We use reasonable age-declaration or verification measures proportionate to the service and require stronger identity checks for vehicle rental, nightlife and other age-restricted services.

We do not knowingly permit children to create independent accounts. If a parent or legal guardian provides a child’s data for family travel, only the minimum information required by the licensed travel Partner or law may be used.

Personal data of a child under 13 will not be collected, processed, shared, tracked or used for marketing unless explicit, documented and verifiable parental consent and every requirement of the UAE Child Digital Safety Law are satisfied.

Suspected unauthorized child accounts or data will be restricted and deleted unless preservation is legally required.

14. Partner and third-party privacy practices

Partners and linked services may collect personal data directly from you and have their own privacy notices.

Where a Partner receives identification or service information directly and determines how it is used, that Partner acts as an independent controller. Its processing is not controlled by this Policy.

Review relevant policies, especially for rental contracts, hotels, airlines, venues, licensed travel operators, Stripe and Apple Pay.

15. Marketing choices

You can opt out of promotional emails using the unsubscribe method provided, change push-notification permissions in device settings, or contact us.

Opting out does not stop essential account, security, receipt, refund or Booking communications. We may retain a minimal suppression record to honour your preference.

16. Data breach response

We maintain incident-response procedures. Where a personal data breach may prejudice the privacy, confidentiality or security of personal data, we will notify the competent UAE authority and affected individuals when and within the period required by Article 9 of the UAE Personal Data Protection Law, and provide the information and protective steps required by law.

17. Changes to this Policy

We may update this Policy to reflect legal, technical or service changes. We will post the updated version and effective date and provide prominent notice where changes are material. If consent is required for a new use, we will request it.

This Policy must be made available in Arabic and may also be provided in English. Both versions are intended to have the same meaning. If there is a conflict, the Arabic version and mandatory UAE law prevail to the extent required by law.

18. Contact us