This site asks for very little and keeps less than most. It also sits in an unusual position: the readers are often in Europe, the cars are in Doha, and the two are separated by a data protection border that genuinely matters. The section on transfers below is the one worth reading even if you skip the rest.
Who decides what happens to your data
In short
Doha Global Group is the controller for this website. A supplier you book with is a separate controller for the rental.
Doha Global Group operates drivedoha.com and is the controller of the personal data described here. If you are reading from the European Union or the United Kingdom, the General Data Protection Regulation applies to that processing, and this policy is written to it.
Once you send a booking request, the supplier that receives it becomes a controller in its own right for everything the rental needs, including your licence details, the card used for the deposit and the vehicle record. That part of your data is governed by the supplier privacy notice, not by this page, and a request about it has to go to them.
What this site collects, and what it never asks for
In short
Search details, the contact details you type into a booking request, anything you write to us, and ordinary server logs. No account, no card number, no passport scan.
A search carries your pickup and return dates and the city, which we forward to the supplier network to get prices back. That is not personal data on its own, and we do not attach a name to it.
A booking request carries what the supplier needs to issue a confirmation, normally a name, an email address and a telephone number, and it is passed on for that purpose alone. Payment happens with the supplier or their payment provider, never on this domain, so a card number does not reach us and we cannot store one. We never ask for a passport, a residence permit or a licence scan, and there is no account to register.
An email you send us carries whatever you put in it, and it stays in the mailbox it arrived in. Beyond that, the web server keeps the ordinary technical log every web server keeps: an IP address, a timestamp, the page requested and the browser string, which is what lets us see that a page is broken or that someone is hammering the search.
Why we are allowed to hold any of it
In short
A booking request runs on the steps you asked us to take before a contract. Logs and security run on legitimate interests. Email runs on your decision to write.
Forwarding a booking request is processing necessary for steps taken at your own request before a contract is entered into. Keeping a server log, limiting abusive traffic and protecting the site rest on our legitimate interest in running a service that works, weighed against how little the log reveals and how briefly it is kept. Answering an email you chose to send rests on the same interest, read fairly.
We do not run advertising profiles, we do not sell data to anyone, and we do not build a picture of you across other websites. There is accordingly no consent banner on this site, because there is nothing here that consent would be the lawful basis for.
Your data crosses a border, and that is not a formality
In short
Qatar sits outside the EEA and is not covered by an adequacy decision, so a real international transfer happens. Standard contractual clauses are the mechanism we rely on.
Several of our destinations are inside the European Union, where sending a booking request to a supplier involves no transfer question at all. This one is different and we would rather say so plainly than bury it. Qatar is outside the European Economic Area, and no European Commission or United Kingdom adequacy decision covers it. When a visitor in the EU or the UK sends a booking request for a car in Doha, personal data genuinely leaves the protected area.
The mechanism we rely on for that is standard contractual clauses: the approved data protection terms that travel with the data and bind the receiving party to handle it to a European standard, supplemented where the United Kingdom requires its own addendum. We transfer only what the supplier needs to issue the confirmation, and nothing beyond it.
You can ask us which safeguard applies to a transfer connected with your own request, and we will tell you. If you would rather no transfer happened, the honest answer is that a car in Doha cannot be booked without one, and the right decision then is not to send the request.
Qatar has data protection law of its own
In short
Qatar has its own personal data protection statute and a government authority that supervises it. We describe it in general terms rather than quoting provisions at you.
Qatar has enacted a national law on the protection of personal data privacy, and a government authority supervises how it is applied. In broad outline it does what you would expect such a law to do: it requires a lawful reason for processing, it expects data to be accurate, limited to the purpose and kept secure, it gives individuals rights over their own information, and it sets rules for telling people when something has gone wrong.
We are deliberately describing it in general terms. Quoting section numbers, naming an exact supervisory body or stating how the statute applies to a website operated from outside the country would mean writing something more precise than we can stand behind, and the whole point of a privacy page is that it is reliable. If you need the position under Qatari law for your own circumstances, take Qatari legal advice. A supplier established in Qatar will have its own obligations under that law, and those obligations are theirs rather than ours.
Who else sees it, and for how long
In short
The supplier you chose, the supplier network that carries the request, and our hosting provider. Logs go in weeks, email as long as the correspondence is useful.
The list is short. The supplier you selected receives your booking request. The supplier network whose feed powers this site carries that request and returns the confirmation. The company that hosts this website processes data on our instruction and for no purpose of its own. We also disclose data where a law or a court order requires it, which has not happened, and we would narrow any such request as far as the law allows.
Server logs are kept for a matter of weeks and then rotated away, because their only use is diagnosing something recent. Email correspondence is kept while it is useful and deleted once it is not. We keep no customer database of our own, because without accounts there is nothing to put in one.
Your rights, and the practical limit on them
In short
Access, correction, erasure, restriction, portability, objection, and a complaint to your own regulator. Ask us by email and we answer within a month.
If the GDPR applies to you, you may ask for a copy of what we hold, ask us to correct or erase it, ask us to restrict or stop a particular use, object to processing based on legitimate interests, and ask for data you gave us in a portable form. You may also complain to the data protection authority in the country where you live, and you do not need our agreement to do so. We apply the same handling to a request from a reader outside the EU and the UK rather than sorting readers by passport.
The practical limit is worth knowing before you write. Once a booking request has reached a supplier, their copy is theirs, under their own notice, and we cannot delete it on your behalf. Ask them directly and ask us in parallel if you want both copies dealt with. We answer within one month and will say so if a request needs longer.
Security, children, changes and contact
In short
Encrypted in transit, not aimed at children, revised without individual notice, and reachable by email only.
Traffic between your browser and this site is encrypted, the booking request travels to the supplier network over an encrypted connection, and access to the server is limited to the people who maintain it. No arrangement is perfect, and the strongest protection here is structural rather than technical: we hold so little that there is very little to lose.
This site is meant for adults arranging a rental, and the minimum driver age in Qatar puts it beyond children in any event. We do not knowingly collect data from a child, and if you believe a child has sent us something, write and we will remove it.
We revise this page when the way the site works changes, and the version published at the time of your visit is the one that applied to it. Questions, or any request about your own data, go to [email protected]. We work by email only and keep no telephone line, which means every request arrives in writing and can be answered the same way.
The Terms and Conditions and the Cookie Policy complete the picture for this site.
Words used on this page
Data protection writing leans on a handful of terms that do not mean in law quite what they mean in conversation. These are the six that carry the weight above.
- Controller
- The party that decides why personal data is collected and what is done with it. On this website that is us. A supplier you book with is a controller of its own in respect of the rental.
- Processor
- A party that handles data only on a controller instruction, such as the company that hosts this site. A processor cannot decide on its own to use your data for something else.
- EEA
- The European Economic Area: the European Union plus Iceland, Liechtenstein and Norway. It matters here because Qatar is outside it.
- Adequacy decision
- A finding by the European Commission, or by the United Kingdom, that a country protects personal data well enough for it to be sent there without further safeguards. No such decision covers Qatar.
- Standard contractual clauses
- A set of data protection terms approved for exactly this situation. Signed between the sender and the receiver, they carry the protection with the data across the border.
- Personal data
- Anything that identifies a living person or could, combined with other information, identify one. An email address is personal data. An anonymous page view count is not.