Privacy Policy

1. Personal Information We Collect

We collect the following categories of personal information, depending on how you interact with the Platform:

• Identity & contact information: name, email address, mobile number, nationality, company name and job title.
• Travel & program information: passport details, visa status, travel dates, group size, dietary and accessibility preferences, and other information you provide to build your Proposal.
• Documents: passport, visa, national ID or other identification documents you upload to our Document Vault.
• Account & usage information: login credentials (stored securely, never in plain text), pages visited, proposals viewed, and interactions with Concierge and Quick Plan.
• Payment information: billing details and transaction records. Card details are processed directly by our PCI‑DSS compliant payment processor and are not stored on MOSARAT's own servers.
• Communications: messages you send us via Concierge, call-back requests, WhatsApp, or email support.

2. Purpose of Collection

We use your personal information to:

• Design, generate, and deliver Proposals and Programs;
• Coordinate bookings with hotels, airlines, transport providers, venues, universities, and other Third-Party Providers and Partners on your behalf;
• Process payments and issue invoices, receipts and refunds;
• Provide customer support and respond to call-back requests and Concierge conversations;
• Send you service communications (e.g. Booking confirmations, itinerary updates) and, where you have consented, marketing communications;
• Improve, secure, and personalize the Platform, including through analytics; and
• Comply with legal, tax, immigration-support, and regulatory obligations.

3. Legal Basis for Processing

We process your personal information where necessary to perform a contract with you (e.g. to deliver a Program you have booked), where we have your consent (e.g. marketing communications), where necessary to comply with a legal obligation (e.g. tax record‑keeping), or where we have a legitimate business interest that is not overridden by your privacy rights (e.g. platform security and fraud prevention).

4. Data Retention

We retain personal information for as long as your account is active and for as long as necessary to deliver a Program you have booked. After that, we generally retain:

• Booking, invoicing and payment records: up to 5 years after the relevant transaction, to meet UAE tax, accounting and regulatory record‑keeping obligations.
• Identity and travel documents uploaded to the Document Vault: deleted or securely anonymized within 90 days after the completion of the relevant Program, unless you request earlier deletion, a longer retention period is required to complete a visa or immigration-related process already in progress, or a longer period is required by law.
• Marketing consent and communication preferences: until you withdraw consent or unsubscribe.
• Account information: until you request deletion of your account, subject to the record‑keeping periods above.

5. Third-Party Sharing

We share personal information, on a need‑to‑know basis, with:

• Hotels, airlines, transport providers, venues, universities, innovation hubs and other Third-Party Providers and Partners, to the extent necessary to deliver your Program (e.g. guest names for hotel check-in, passport details for visa processing);
• Payment processors and financial institutions, to process payments and prevent fraud;
• Technology providers who host, secure, or support the Platform (e.g. cloud hosting, analytics, communications tooling), under contractual confidentiality and data‑protection obligations;
• Government or regulatory authorities, where required by law (e.g. visa sponsorship, immigration or tax authorities); and
• Professional advisors (legal, audit) where necessary to protect our legal rights.

6. Marketing Consent

We will only send you newsletters, promotions, or other marketing communications where you have opted in to receive them. You may withdraw your consent at any time by using the unsubscribe link in any marketing email or by contacting us at support@mosarat.com. Withdrawing marketing consent does not affect service communications relating to an active Booking.

7. International Transfers

MOSARAT is based in the United Arab Emirates. If you access the Platform from outside the UAE, or if a Program involves Third-Party Providers or Partners located outside the UAE, your personal information may be transferred to, stored, and processed in other countries. Where required, we take reasonable steps (including contractual safeguards) to ensure such transfers provide an adequate level of protection consistent with applicable data protection laws.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of your personal information, subject to our legal, tax, and contractual record‑keeping obligations;
• Withdraw consent to marketing or other consent‑based processing at any time; and
• Object to certain processing carried out on the basis of legitimate interest.

9. Data Security

We apply administrative, technical, and physical safeguards designed to protect your personal information, including encryption of documents stored in our Document Vault, access controls limiting staff access on a need‑to‑know basis, and secure hosting infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work continuously to protect your information and to detect and respond to any incident.

10. Cookies & Analytics

The Platform uses cookies and similar technologies, together with analytics tools, to operate core functionality, remember your preferences, and understand how the Platform is used so we can improve it. You can control cookies through your browser settings; disabling certain cookies may affect Platform functionality.

11. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal information from, individuals under 18 years of age. If we learn that we have inadvertently collected personal information from a minor without appropriate consent, we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy with a revised effective date, and material changes will be highlighted on the Platform.

13. Governing Law

This Privacy Policy is governed by the laws of the United Arab Emirates only. Any dispute relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts of the United Arab Emirates only.

14. Contact Us

To exercise any of your rights, or if you have questions about this Privacy Policy, contact us at support@mosarat.com.