There are exactly two cookies on this site, one third party script that may load, and one browser store that people routinely mistake for a cookie. That is the whole inventory. No advertising pixel runs here, nothing follows you to another website, and there is no consent banner because there is nothing on this page that consent would be the basis for.
The session cookie: how the server recognises one visit
In short
One strictly necessary cookie, named after this site, set by the web framework, readable only by the server, and expiring within hours.
The site runs on the Laravel framework, which issues a session cookie whose name is derived from this site rather than a generic label. Its value is an encrypted identifier and nothing else: no name, no email address, no search history, no profile. It exists so that the server can tell that two requests belong to the same visit, which is what makes a form submission work at all.
It is marked as readable only by the server rather than by scripts in the page, sent only over an encrypted connection, and restricted so that another website cannot cause your browser to send it. It expires on its own within a few hours of your last request, and it carries no identifier that would let anyone recognise you on a later visit.
The security token: proving a form came from this page
In short
A second strictly necessary cookie, XSRF-TOKEN, that protects your form submissions from being forged by another site. It expires alongside the session.
The cookie named XSRF-TOKEN holds a cross site request forgery token. The page reads it and sends the value back with a form submission, and the server refuses anything that arrives without a matching token. That is what stops another website from quietly submitting a search or a review on your behalf while you have this one open.
Unlike the session cookie it has to be readable by the page, which is how the value reaches the form. It carries no personal data, it is restricted to an encrypted connection in the same way, and it expires on the same short timetable. Blocking it breaks every form on the site, which is why it belongs in the strictly necessary category rather than behind a choice.
The booking widget is somebody else's code
In short
A supplier booking script loads only when you open a booking, and what it stores is governed by that company rather than by us.
Browsing and comparing cars on this site loads nothing from a third party. The booking widget provided by the supplier network is deliberately held back until you actually open a booking, so a visitor who reads a guide and leaves never runs it at all.
Once it does load, it is that company code running in the page, and it may set storage of its own to carry your booking through its own steps. We do not control what it sets and we would be guessing if we listed it item by item here, so we are telling you it exists instead. If you want to see it, open the storage panel in your browser developer tools before and after you open a booking, and the difference is entirely theirs.
The one practical consequence is that blocking third party scripts for this domain leaves the site perfectly readable and the search working, while the booking step will not complete.
Your search results are cached, and that is not a cookie
In short
The last few minutes of car results are kept in your own browser local storage. It never leaves your device and it is not sent to any server.
When a search returns, the list of cars is written to local storage in your browser under a key beginning with the letters lrCars, and it is read again if you repeat the same search within the next few minutes. That is why going back to a results page feels instant instead of waiting on the supplier network a second time. Only a handful of recent searches are kept, and each one is discarded once it goes stale.
It is worth being precise about the difference, because it is the point most cookie pages blur. Local storage is not a cookie. A cookie is attached to every request your browser makes to this site, which is what lets a server use it to recognise you. Local storage is never attached to anything: it sits in your browser, it is readable only by pages on this domain, and no part of it is transmitted to us or to anyone else. What is cached there is public car availability, not anything about you, and clearing cookies alone does not clear it.
Clearing or blocking each of these
In short
All four are under your control from the browser, and nothing here needs an account or a request to us.
The two cookies go with any ordinary clearing of browsing data, and both are gone the moment you clear cookies for this site. You can also block cookies for this domain outright in browser settings, with the consequence noted above: the site still reads, and the forms stop working.
Local storage needs the separate option, usually labelled cached data, site data or hosted app data depending on the browser. Clearing all site data for this domain removes it, or you can open developer tools, find local storage under the storage panel, and delete the lrCars entries individually. A private browsing window does both jobs at once, since cookies and local storage are discarded when the window closes.
The supplier script is blocked by a content blocking extension or by turning off third party scripts for this domain. Everything on this site except the booking step keeps working if you do.
Changes, and how to ask about this
In short
If the inventory changes, this page changes with it. Questions go to the email address below.
This page lists what the site stores today. If we add anything, or if the supplier network changes what its widget does, we update the list here rather than quietly letting it drift. Individual visitors are not notified, so read it again if you are relying on it.
Questions about anything described here go to [email protected]. Doha Global Group works by email only and keeps no telephone line. If you find something stored in your browser by this domain that is not on this page, send us the name of it and we will either explain it or remove it.
See also the Privacy Policy and the Terms and Conditions.
Words used on this page
Cookie policies lean on a vocabulary that is rarely explained anywhere. These six terms are the ones that decide whether the rest of this page means anything.
- Cookie
- A small piece of text a website asks your browser to store and send back on the next request. It travels with every request to that site, which is what makes it useful and what makes it worth regulating.
- Session cookie
- A cookie that identifies one browsing session rather than one person. It lets a server recognise that two requests came from the same visit.
- Strictly necessary
- The category of cookie a site may set without asking permission, because the thing you asked for cannot work without it. Both of the cookies here fall into it.
- CSRF token
- A value that proves a form submission came from the page it claims to come from. Without one, another site could quietly submit a form on your behalf.
- Local storage
- A separate browser store, much larger than a cookie, that stays in your browser and is never attached to a request. The distinction matters: it is not a cookie, and clearing cookies does not clear it.
- Third party script
- Code loaded from another company and run inside this page. It can do things the page itself did not do, which is why it is listed separately here.