Privacy Notice
Premium Choice Travel DMCC · Version 2026-09-27 · Effective 27 September 2026
This document is a draft awaiting legal review. Items marked [●] are still to be completed.
This notice explains how Premium Choice Travel DMCC (Premium Choice, we), of [registered address ●], Dubai, United Arab Emirates, handles personal data in connection with Premium Choice Travel Designers. It covers the website at premiumchoicetraveldesigners.com, the agency portal, the API and our trade relationship with agencies.
We are the controller of the personal data described here, except where section 4 says we act for your agency. Contact us about privacy at [privacy contact email ●].
1. Whose data this covers
- People who work for travel agencies: account owners, managers, agents and finance staff who use the portal, and people who contact us or apply for an account.
- Travellers: the people named on bookings your agency makes. See section 4 for how we handle their data.
- Contacts at suppliers and hotels we work with.
- Visitors to our website.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and identity | Name, job role, business email, business phone | You, when you apply or are invited |
| Account and security | Login email, password (stored only as a one-way hash), sign-in sessions, multi-factor settings, roles and booking limits | You and your account owner |
| Business verification | Trade licence, registration and VAT details, and documents you upload. We do not ask agencies for passports or Emirates IDs as a matter of course | Your agency |
| Activity | What you search, quote, hold, book, change and cancel, with the time and the user who did it | The Platform |
| Communications | Support tickets, booking messages, emails we send you | You, and us |
| Marketing preferences | Whether you asked to receive product news | You |
| Technical | IP address and browser details in server logs, recorded to keep the service secure | Your device |
| Traveller data | Names, and for some products age, contact phone, flight or train numbers, answers an activity provider needs, and, for flights, date of birth and passport details | Your agency |
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Opening, verifying and running your agency's account; making and managing bookings; invoicing | Performing our contract with your agency; our legal obligations |
| Verifying a business and preventing fraud, misuse and sanctions breaches | Our legitimate interests; our legal obligations |
| Keeping records for tax, accounting and audit | Our legal obligations |
| Support, and service messages about bookings, payments and your account | Performing our contract |
| Product news and offers | Your consent, which you can withdraw at any time |
| Improving the Platform and keeping it secure | Our legitimate interests |
Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) applies, we process personal data on the grounds it allows. Where the EU or UK General Data Protection Regulation applies, the legal bases above are those we rely on.
4. Traveller data
When your agency gives us a traveller's details to make a booking, we process them to fulfil that booking. That means sending them to the supplier, issuing documents and handling changes, cancellations and support. For that purpose we act on your agency's instructions, under our Data Processing Addendum.
Suppliers receive the data they need to provide the service. They use it under their own responsibility. For example, an airline uses passenger data to issue a ticket and to meet border requirements.
For flights, we pass the traveller's date of birth, contact details and passport details to the airline through our flight provider. We do not keep them on the booking.
We also keep booking records for our own legal, tax and fraud-prevention purposes. For those purposes we are a controller.
5. Who we share data with
We share personal data only as needed for the purposes above:
- Suppliers: hotels, bed banks (such as Hotelbeds), airlines through our flight provider (Duffel), transfer and activity providers. This is to make and manage bookings.
- Hosting and database: Vercel and Supabase, in Singapore. Supabase also stores uploaded files.
- Email delivery: Resend.
- Card payments: Stripe, when card payments are enabled. Card details go directly to Stripe and never to us.
- Address search for transfers: Photon, operated by komoot. The address text you type is sent to it.
- AI services: Anthropic, to read supplier contracts we load, and, if you use the search assistant, the words you type there. The assistant does not need traveller names, and you should not enter them. Its output never sets a price.
- Map tiles: your browser loads map images from OpenFreeMap when you view a map. OpenFreeMap receives your IP address, as any website you load does.
- Professional advisers, auditors, banks and insurers, where needed.
- Authorities, where the law requires it or to protect rights, safety and property.
- A buyer of all or part of our business, under confidentiality.
We do not sell personal data.
6. International transfers
Our Platform is hosted in Singapore. Some service providers are in the United States, the European Union or the United Kingdom, and suppliers may be anywhere in the world where a service is provided.
When we transfer personal data outside the UAE, we do so as the PDPL permits. That can mean relying on the adequacy of the destination, appropriate contractual safeguards, or a transfer necessary to perform a contract with or for the data subject, such as a hotel booking abroad.
7. How long we keep it
| Data | How long |
|---|---|
| Account, booking, invoice and payment records | While your account is open, then for as long as UAE commercial and tax law requires, which is at least five years |
| Verification documents | While your account is open, then five years |
| Support tickets and messages | Five years after they close |
| Server logs | Up to 90 days, unless needed to investigate an incident |
| Marketing preferences | Until you withdraw consent or your account closes |
[Retention periods to be confirmed with counsel and put into operation.]
8. Security
We protect personal data with appropriate technical and organisational measures:
- encrypted connections;
- passwords stored only as salted one-way hashes;
- per-agency access controls enforced by the database itself;
- individual logins, and multi-factor authentication for privileged users;
- audit records of who changed what.
No system is completely secure. We will tell affected people and the authorities of a breach as the law requires.
9. Your rights
Depending on the law that applies to you, you may ask us to:
- access your personal data;
- correct it;
- delete it;
- restrict or object to its processing;
- transfer it;
- withdraw consent. Withdrawing consent does not affect processing already done.
You also have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.
To exercise a right, contact [privacy contact email ●]. We may need to verify who you are. Travellers should usually contact the agency that made their booking, which will involve us where needed. You may also complain to the UAE Data Office, or to the data protection authority where you live.
10. Cookies
Our Cookie Notice explains the one cookie we set and what the portal keeps in your browser.
11. Changes
We will publish any change to this notice here, with a new version date, and tell account holders of significant changes.