1. Who we are
This Privacy Policy explains how Rexer Group L.L.C-FZ (“Rexer,” “we,” “us,” or “our”), a company registered in Meydan Free Zone, Dubai, United Arab Emirates, collects, uses, shares, and protects personal data in connection with the Rexer mobile application and related services (the “Platform”).
This Policy is governed by applicable UAE privacy law, including Federal Decree-Law No. 45 of 2021, and relevant transport requirements. It describes our service processing and the rights and safeguards that apply.
Rexer acts as the data controller for the personal data described in this Policy, except where stated otherwise. This Policy applies to riders who use the Platform to book trips, and to drivers and RTA-licensed limousine operators (“Operators”) who provide trips through the Platform.
Rexer is a technology intermediary connecting riders with RTA-licensed limousine Operators and their drivers. Rexer is not a transport operator and does not employ drivers.
2. Data we collect
We separate this section by who the data relates to, and describe each in plain categories consistent with how this data is reported to Apple App Store and Google Play Store.
2.1 Riders
We collect the following categories of data about riders who use the Platform:
| Category | What we collect | How we collect it |
|---|---|---|
| Personal info | Account ID, name, registered mobile number, email, profile photograph and optional profile details provided during registration or later updates. | Provided directly by the rider at registration |
| Financial info | Payment method details (tokenised by Stripe; Rexer does not store raw card numbers), wallet (Rexer Wallet) balance and transaction history | Provided directly by the rider via Stripe; generated by the Platform during use |
| Location | Pickup and drop-off location, live trip route, during pickup selection, booking and active trips | Collected directly from the rider's device, with permission, during trip booking and active trips |
| App activity | Trip history, in-app support messages, ratings given to drivers, app interaction and crash diagnostics | Generated by the Platform during use |
| Identifiers | Device identifier, mobile OTP verification record | Generated during account verification via Message Central |
| Trip and guest records | Trip ID, booking times, pickup/drop-off, route summary, assigned driver/vehicle, trip status, fare, payment references and guest contact details where supplied. | Booking and trip records; guest details provided by the booking account holder. |
| Support and evidence | Ticket ID, messages, PDF/images and other supported attachments, requested information, decisions, replies and notification status. | In-app support and authorised support handling. |
| Preferences and consent | Saved places, language/appearance preferences, policy acceptance, journey sharing, separate survey-invitation consent, promotional preferences and optional usage-data consent/withdrawal. Survey responses are collected only when voluntarily submitted. | Customer selections and recorded service permissions. |
Riders do not undergo identity-document verification. Registration uses mobile OTP verification and the applicable payment setup. Protected profile changes, temporary deactivation, dormant-account recovery and permanent deletion also use registered-email verification or verified Support assistance, as described in Section 1.14.
2.2 Drivers
The limousine Operator supplies driver identity, licensing and vehicle compliance information. Rexer also receives driver login, location, shift, safety-check, trip, payment-confirmation and support information directly through the Rexer Driver Application during its use.
| Category | What is collected | Source |
|---|---|---|
| Personal info | Driver ID, name, mobile number, nationality, date of birth, photograph and company association. | Submitted by the Operator |
| Government ID | Driving licence, Emirates ID, passport, visa and RTA driver permit/card; issue/expiry dates and required evidence. | Submitted by the Operator |
| Vehicle info | Vehicle ID, model, category, colour, registration, insurance and permit evidence, seating/luggage capacity and approved accessibility or child-seat equipment. | Submitted by the Operator |
| App activity | Login and device events, online shift location, trips and breaks, safety checklist, ratings, cash confirmations and support messages | Rexer Driver Application during use |
| Support and safety | Ticket references, messages, supported attachments, found-item reports, safety reports, actions and notifications. | Driver in-app support and authorised company/Rexer case handling. |
Section 4.2 explains Operator-supplied driver data and how drivers can exercise their rights.
2.3 Limousine companies and authorised staff
For limousine Operators and authorised portal staff, Rexer holds company identity and licensing details, representative and authority evidence, approved settlement banking details, staff name and work contact, User ID, role, permitted company scope and action history. These support onboarding, protected access, approvals, company settlements and accountability. Bank details are disclosed only to authorised finance personnel; routine reports do not expose identity documents or credentials.
| Category | Data collected | Purpose |
|---|---|---|
| Company onboarding | Company ID, name, address/contact details, trade licence, contract, representative identity and authority/POA. | Create and verify the limousine partner relationship and authorised access. |
| Company finance | Verified settlement bank details, earnings/statement references, company payments and approved bank changes. | Reconcile and settle with the company; verify approved financial changes. |
| Authorised staff | Staff/User ID, name, profile photograph, registered work contact, role, company scope, access and approval history. | Identify portal users, enforce permissions and record accountable actions. |
2.4 Information we do not collect
- We do not collect identity documents from riders.
- We do not collect biometric data (facial recognition, fingerprints, or similar) from riders or drivers.
- We do not record audio during trips.
Rider location supports pickup selection, booking and passenger-authorised journey information functions. Driver location supports work during an online shift and active journeys, including authorised background updates. Ordinary location updates stop when the driver goes offline or ends the shift; an active journey continues to provide necessary location information until safely completed. Location is not collected continuously outside these service functions.
3. How we use personal data
We process your personal data under the lawful grounds established by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and applicable Dubai transport regulations, as outlined below:
| Purpose | Lawful basis |
|---|---|
| Creating and managing rider and driver/vehicle profiles | Performance of Contract |
| Matching riders with available drivers, trip routing, and calculating fares | Performance of Contract |
| Processing payments, fare splits, and wallet (Rexer Wallet) transactions | Performance of Contract |
| Safety monitoring, platform integrity, fraud prevention, and dispute handling | Performance of Contract / Explicit Consent |
| Customer support and incident investigation | Performance of Contract |
| Regulatory recordkeeping, trip audits, and mandatory compliance with the Dubai Roads and Transport Authority (RTA) and UAE authorities | Legal & Regulatory Obligation |
| Direct marketing communications, promotional offers, feature updates and separately consented survey invitations | Explicit Opt-in Consent |
| Aggregated platform performance and service analytics | Explicit Consent / De-identified statistical processing |
Survey invitations require a separate opt-in from promotional communications, journey information sharing and optional app-usage data sharing. Participation is voluntary; withdrawing invitation consent stops future invitations without affecting the service or the other controls. A completed survey is handled under its stated purpose and the applicable retention schedule. Driver-rating prompts remain a separate journey function. Optional personalised recommendations, promotions and identifiable preference analytics require the applicable separate consent. Withdrawal stops that optional use without stopping essential service processing. Core diagnostics and genuinely anonymised service statistics support reliability. Future AI features are outside the initial service; material new data uses require updated notice and any required consent.
Support chat and evidence: The app automatically supplies the signed-in Account ID and known Trip ID or transaction reference. We process messages, uploaded files, ticket classification, agent ownership, decisions, replies and delivery status. Only authorised recipients can access the case. Driver–rider coordination and Customer Care conversations remain separate even where they share messaging infrastructure. Do not upload unnecessary sensitive data about yourself or others.
4. Who we share data with
We share only data necessary for the functions below with authorised service providers, the assigned Operator, relevant trip participants and competent authorities where lawfully required. We do not sell personal data.
| Third party | Purpose | Data involved |
|---|---|---|
| Stripe | Payment processing (PCI-DSS Level 1 certified) | Payment method details, transaction amounts |
| Google Maps Platform | Routing, geocoding, navigation, fare distance calculation | Pickup/drop-off location, route data |
| Message Central | SMS one-time passcode (OTP) delivery for account verification | Mobile phone number |
| RTA-licensed limousine Operators | Driver/vehicle onboarding and trip fulfilment | Driver and vehicle documents; trip assignment data |
| RTA (Roads and Transport Authority) | Regulatory compliance and recordkeeping, where legally required | Trip records, as required by applicable regulation |
| Odoo and authorised chat/notification providers | Support ticketing, agent replies, attachments and service alerts | Account/trip references, messages, evidence, status and delivery metadata |
| Assigned rider/driver and authorised sharing recipients | Trip coordination, guest service and consent-based journey sharing | Necessary trip, vehicle, contact and location information; secure expiring sharing link |
| Google Maps or Waze when opened for external navigation | Driver-selected turn-by-turn navigation | Coordinates needed to open the route; the external application also applies its own privacy terms |
Each third party listed above is contractually required to provide a level of protection for personal data consistent with this Policy, and is permitted to use the data only for the stated purpose.
4.1 Hosting and data residency
Rexer's platform, account and trip databases are hosted in the UAE. Authorised payment, mapping, messaging and support providers may process the necessary data in other locations subject to the transfer safeguards in Section 5.
4.2 Indirect collection of driver data
Initial driver identity and compliance information comes from the limousine Operator. Operational app data also comes from the driver's use of Rexer. Our agreements require Operators to:
- Inform the driver, before submission, that their personal data will be shared with and processed by Rexer for the purpose of enabling the driver's use of the Platform;
- Provide the required notice and establish an applicable lawful basis for sharing; obtain valid consent where the processing requires it.
- Notify Rexer of relevant corrections, rights requests and consent withdrawal where applicable.
Regardless of how their data was first collected, drivers may contact us directly using the details in Section 11 to exercise any of the rights described in Section 7.
5. International transfers
Some authorised technology providers may process data outside the UAE. Transfers follow the applicable UAE PDPL requirements, using an available lawful transfer mechanism and suitable contractual, access and security safeguards. UAE primary hosting does not mean every connected provider processes data exclusively within the UAE.
We ensure that all cross-border transfers are protected through:
- Transfers to jurisdictions or entities providing an adequate level of data protection approved by the UAE Data Office; or
- Appropriate contractual safeguards, including standard contractual clauses, binding corporate mechanisms, and robust technical encryption standards ensuring recipient compliance with UAE privacy levels; or
- An applicable legal exception where necessary for the requested contract or another permitted purpose; encryption alone is not a legal transfer mechanism.
6. Data retention
We retain data according to its purpose and applicable obligations. The periods below distinguish Rexer operational policy from financial recordkeeping; UAE privacy law does not impose a universal five-year period for all personal data.
Operational trip and shift records are retained for 2 years after completion. Financial evidence required for corporate-tax recordkeeping is retained for 7 years after the relevant tax period. A longer applicable legal requirement or documented investigation hold takes precedence for the necessary records only.
Rider account data: Retained while active. On requested temporary deactivation, necessary account/recovery data is restricted for up to two years to support a verified return; no new booking use is permitted. Original-account ownership checks supplement mobile OTP verification. The ID remains reserved for the same customer. Optional promotional communications, survey invitations and usage-data processing stop during dormancy; record-specific retention periods continue independently.
Dormant account expiry: A reminder is sent 30 days before the recorded two-year deadline. Unless the customer reactivates or requests earlier deletion, expiry initiates permanent closure and review of eligible wallet funds. Ordinary profile data is removed within 30 days of verified permanent deletion or expiry processing, subject to documented lawful holds. Permanently deleted/expired accounts cannot be reactivated; retained financial or dispute evidence remains restricted and does not recreate the account.
Driver and vehicle compliance records are retained during the active relationship and for 2 years after exit under Rexer operational policy, unless a documented regulatory requirement, claim or legal hold requires longer retention. Replaced evidence copies are removed when no longer necessary.
Detailed location telemetry is retained for 90 days after the trip or shift, then deleted unless needed for a recorded investigation or lawful hold. Necessary pickup, drop-off and route summary remain in the operational trip record. We do not retain raw location indefinitely for optional profiling.
Ordinary support tickets, chat messages and evidence files are retained for 12 months after closure, then deleted or irreversibly anonymised. Reopening before disposal restarts the closure-based period. Financial, safety or legal evidence required for another purpose is separated and restricted under that record's applicable retention or hold.
Account deletion removes ordinary profile data within 30 days after the verified request and disables access. It does not immediately erase required financial records or unresolved claims. Backups rotate out through the normal recovery cycle within 90 days; restored systems reapply completed deletion requests. Holds identify their purpose, owner and review date and do not justify keeping unrelated data.
7. Your rights
Subject to Federal Decree-Law No. 45 of 2021 (UAE PDPL), you have the right to:
- Access and obtain a copy of your personal data;
- Request the correction or updating of inaccurate or incomplete personal data;
- Request the erasure (deletion) of your personal data where the data is no longer necessary for the purposes collected, or where consent is withdrawn and no other legal basis applies, subject to mandatory statutory and regulatory retention obligations (including RTA and accounting requirements);
- Request the restriction or stopping of processing of your personal data in certain circumstances;
- Object to automated decision-making and profiling where automated processing produces significant legal or contractual effects;
- Receive your personal data in a structured, machine-readable format (data portability);
- Withdraw your consent at any time where processing was grounded on consent;
- File a complaint with the UAE Data Office if you believe your personal data has been handled in breach of the UAE PDPL.
Response timeframes: access requests are fulfilled within 30 days; correction requests within 7 days; deletion requests within 30 days, subject to retention obligations described in Section 6.
7.1 How to exercise your rights
Riders and drivers may request access, correction, a copy, restriction or deletion through in-app support or the contact below. Rider account deletion is available in the application. Driver profile and compliance corrections are coordinated with the limousine Operator, without preventing a driver from contacting Rexer directly. A dedicated privacy dashboard is not required to exercise these rights.
You may also exercise any of these rights by contacting us using the details in Section 11.
8. Children's privacy
Account registration is for adults aged 18 or over. An adult booking for a permitted guest may provide the passenger's name and mobile number, including where a lawful booking involves a minor. We use only the necessary service and safety data; we do not create a minor's independent rider account. Contact us if passenger data has been provided without appropriate authority.
9. Security and incident notification
We apply industry-standard security measures to protect personal data, including encryption of data in transit, access controls limiting data access to authorised personnel, and regular review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Rexer assesses security incidents, protects affected records and notifies the competent authority and affected individuals where required by applicable law, without undue delay and within any applicable mandatory timeframe. Incident notices state the relevant impact and protective steps.
10. Governing law and disputes
This Privacy Policy and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the federal laws of the United Arab Emirates and the local laws of the Emirate of Dubai.
Any dispute arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts of Dubai, without prejudice to any RTA-mandated dispute or complaints process applicable to licensed limousine operations.
11. Contact us
For privacy questions, rights requests or concerns, contact the Rexer privacy team using the details below. Requests are verified proportionately; do not send passwords, login codes or full card details.
- Email: support@rexer.group, with the subject “Privacy / DPO Inquiry”.
- Postal address: Rexer Group L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates
12. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified in-app or by email before taking effect. The “Effective date” at the top of this Policy indicates when it was last updated.