Privacy Policy

Version 2026-09, effective 9 September 2026

1. Who is responsible for your information

Premium SmartStay Home Rental L.L.C, a limited liability company licensed by the Dubai Department of Economy and Tourism under licence 1164028 ("SmartStay", "we", "us" or "our"), is responsible for personal information where we decide why and how it is used. Contact us about privacy at legal@smartstay.me.

This policy covers information connected with smartstay.me, book.smartstay.me, our enquiries, booking and guest services, property management, owner and representative relationships, and related communications and operations. It applies to information collected online and offline, directly from you and from the sources described below. It covers prospective customers, guests, other occupants and visitors, cardholders, owners and their representatives, and business contacts. Employment and recruitment information may be addressed in separate notices.

Companies in our group and external providers may support these activities. This does not mean that every group company receives all information. A booking platform, payment provider, building manager or another company may also process information for its own purposes under its own privacy notice. The contracting company is identified in your applicable agreement; responsibility for personal data depends on the actual processing role.

This policy explains our practices and your choices. Reading it, using a website or accepting an agreement does not, by itself, give consent to every use of personal information.

2. Information we collect

The information depends on your relationship with us and what is needed for the relevant purpose. It may include:

• Identity and contact information: names, contact details, nationality, date of birth, passport or Emirates ID details and copies, signatures, and identity-verification photographs or selfies where required for the relevant verification process.
• Booking and stay information: reservation references, dates, property, occupants, visitors, preferences, requests, communications, registration and check-in records, accepted agreements and their timestamps, access arrangements, and support or incident records.
• Payments and accounts: charges, invoices, payment status, transaction references, refunds, deposit and damage records, bank details for authorised payments or refunds, and cardholder verification information. Payment-card verification images requested under our guest agreement must show only the last four digits. Do not send full card images or card security codes through ordinary email or messaging.
• Property and authority information: addresses, ownership and title documents, permits, identity and authority documents, powers of attorney, contracts, property condition and inventory records, financial statements, payout details and correspondence.
• Communications and evidence: emails, messages, enquiries, call notes and recordings where calls are recorded, transcripts, feedback, complaints, photographs, videos, maintenance records and evidence relevant to safety, damage, fraud, insurance or disputes.
• Access and monitoring information: smart-lock and access logs, device alerts, noise-level and smoke-monitoring information, and images or recordings from disclosed cameras or doorbells in the circumstances described in section 6.
• Website and preference information: IP address, device and browser information, page and interaction data, approximate location, referral information, and records of privacy or marketing choices. The technologies actually used depend on the website or service you visit.

Sensitive information, such as health details provided for an accessibility request or information in an incident report, is handled only where relevant and legally permitted. Please avoid sending sensitive information that is unnecessary for your request. A photograph or selfie is not necessarily used for automated biometric identification; any such identification process requires its own appropriate information and legal basis.

3. Where information comes from

We receive information from you through websites, booking or guest portals, forms, telephone calls, email, messaging, in-person dealings and the services you use. We may also receive it from a lead guest or other authorised representative, an owner or agent, booking platforms, payment and verification providers, service contractors, building management, authorities, and publicly available or lawfully accessible records relevant to verification or a claim. Operational systems and disclosed devices generate some information automatically.

If you give us another person's information, you must have authority or another lawful basis to do so and provide them with this policy where appropriate. This includes other occupants, visitors, cardholders and property representatives. We may provide information to them directly when required.

4. Why we use information and the basis for doing so

We use relevant information to:

• answer enquiries, prepare offers and take requested steps towards a booking or other agreement;
• enter into, perform, administer and renew agreements, manage bookings and properties, provide access and services, collect payments, make refunds and payouts, and communicate about those activities;
• register properties and guests, verify required information, report to the Dubai Department of Economy and Tourism or other competent authorities, maintain accounts and comply with tax, legal and regulatory obligations;
• protect guests, staff, property and systems; investigate incidents, misuse and suspected fraud; verify payment authority; handle complaints, insurance, chargebacks, debt recovery and legal claims;
• coordinate staff, companies in our group and service providers, manage maintenance and quality, and improve the reliability of our services;
• support communications and administrative work using authorised software, automation and AI-assisted tools, as explained in section 7; and
• understand use of our services and communicate offers where legally permitted and subject to the choices described in sections 8 and 9.

Under UAE data-protection law, we rely on consent or an applicable statutory exception, including processing necessary for a contract or requested pre-contract steps, specific legal obligations, the establishment or defence of rights, and protection of relevant interests where the law permits. We do not treat a general business interest as an unrestricted permission to process information.

Where EU or UK data-protection law applies, the basis depends on the purpose: contract for a contract with you or steps you request; compliance with an obligation recognised by that law; legitimate interests for necessary and proportionate administration, security, fraud prevention, quality and claims handling after balancing your rights; or consent where required. A UAE reporting duty is assessed separately for the purposes of those laws and is not automatically an EU or UK legal-obligation basis. Additional conditions apply to sensitive information and relevant international transfers. We rely on consent for optional marketing or tracking where required, rather than making it a condition of accommodation or owner services.

If required identity, registration, payment or authority information is not provided, we may be unable to conclude or perform the relevant service, complete registration or provide access. The consequences for a booking are governed by its agreement and applicable law. Optional marketing choices do not affect those services.

5. Who may receive information

We share relevant information, for the purposes above and with an appropriate legal basis, with:

• authorised staff and companies in our group providing booking, guest support, property operations, finance, technology or administrative services;
• booking platforms and booking-system, guest-portal, hosting, cloud-storage, communications, software and AI service providers;
• payment, banking, identity-verification and fraud-prevention providers;
• owners, authorised representatives, building management, security, cleaning, maintenance and other contractors where information is needed for the relevant property or service;
• insurers, auditors, lawyers, professional advisers, debt-recovery providers, courts, police, regulators and other competent authorities; and
• parties and advisers involved in a proposed or completed business transfer, restructuring or transfer of operations, subject to lawful disclosure, confidentiality and appropriate safeguards.

Access and disclosure are limited to what is relevant for the purpose. An owner or contractor does not receive unrestricted access to guest identity or payment documents merely because they are involved with a property. Providers processing information on our behalf must be subject to appropriate instructions and data-protection arrangements. Independent controllers are responsible for their own processing.

Generic references to our group or providers do not authorise those recipients to send their own unrelated marketing. Any additional consent required for that activity must be obtained separately.

6. Cameras, sensors and access records

Buildings may have CCTV in entrances, lifts, corridors or other common areas controlled by building management or another independent operator. Their notices apply to their operation of those systems. We may receive relevant footage where lawfully needed to investigate an incident, protect people or property, or handle a claim.

Some properties have company-controlled video doorbells or other disclosed cameras monitoring the entrance or other permitted exterior or common areas. Device-specific information identifies the relevant location and operation. We do not use cameras to monitor the private interior of a holiday home. Applicable listing and on-site disclosures supplement this policy.

Noise-level monitors inside a property measure sound levels rather than record conversations. Smoke-monitoring and safety devices may record readings and alerts. Smart locks and access systems may record entry events, credentials used and related technical logs. These systems support security, safety, access management and investigation of house-rule incidents. Not every property has the same devices.

For information about a particular property's devices, recordings, access or retention, contact us with the property or reservation reference. This policy does not replace any location-specific disclosure required before booking or at the property.

7. Automation and AI-assisted services

We use software, automation and AI-assisted tools to support tasks such as routing and answering enquiries, preparing or translating communications, summarising records, reviewing service quality and organising operations. These activities may involve information needed for the task being processed by an authorised provider, with appropriate confidentiality and data-protection arrangements.

You may ask to speak to a person or request review of a response or decision that affects you. Where applicable law gives you rights concerning automated decisions or profiling, including human review, you can exercise them through legal@smartstay.me. This policy does not itself authorise solely automated decisions with legal or similarly significant effects, biometric identification, or use of your information to train an unrelated public AI model. A materially different processing activity requires the relevant information, safeguards and legal basis before it is introduced.

8. Marketing and your choices

We may send information about our services and offers through channels such as email or WhatsApp where permitted by applicable law and, where required, on the basis of your consent. Consent must relate to the sender, purpose and communication channel concerned. Booking a stay, providing a passport or accepting an agreement is not automatic consent to optional promotional messages.

You can ask us to stop direct marketing at any time by replying to the message, using an available unsubscribe option or contacting legal@smartstay.me. Withdrawal does not affect processing lawfully carried out before withdrawal. We may keep the minimum information needed to record and honour an objection so that you are not added back to marketing inadvertently.

Operational communications, such as booking confirmations, registration requests, access information, invoices and notices concerning an agreement, may continue where necessary for the service or another lawful purpose. We do not use children's registration information to target them with marketing.

9. Cookies and similar technologies

Websites, booking tools and embedded services can use cookies, local storage and similar technologies to maintain a session, provide functionality, support security and remember settings. Optional technologies may also measure use or support advertising. Different services can set their own technologies and process information in accordance with their respective roles.

The booking website uses Google Analytics to measure visits and interactions, involving device information, online identifiers and usage data being sent to Google. It also includes a Conduit messaging service. Cookies set for the parent smartstay.me domain can be available across its main and booking websites. These technologies are distinct from the personal information you deliberately submit in a booking or message.

Where the law requires prior consent for a technology or its purpose, that consent must be obtained before it is used. This policy, continued browsing and acceptance of a booking agreement do not replace that consent. Where a website provides cookie choices, you can use those controls. You can also manage cookies through your browser, although blocking necessary cookies may affect functionality and browser settings do not control every type of tracking. Contact us at legal@smartstay.me for information about the technologies used on a particular service or to exercise your personal-data rights.

10. International access and transfers

Our staff, companies in our group and service providers may access or process information from the UAE and other countries. Hosting, support and other processing locations depend on the service used. Other countries may have different data-protection laws.

A transfer must have a lawful basis and meet the applicable transfer requirements. Depending on the law and transfer, this may require recognised protection, contractual safeguards and additional measures, or a permitted exception. We do not rely on acceptance of this policy as blanket consent to international transfers. You may request information about relevant destinations and applicable safeguards, including how to obtain a copy where you have that right, at legal@smartstay.me.

11. How long information is kept

Retention depends on the information and its purpose. The criteria include whether an enquiry or agreement remains active; registration, tax, accounting and other record-keeping duties; payment disputes and insurance requirements; applicable limitation periods; the likelihood and status of a complaint or claim; and the need to preserve evidence or honour a privacy preference.

The end of a stay or management agreement does not necessarily require every record to be deleted immediately. Information needed for a legal obligation or a specific claim may be retained for that purpose. This does not justify keeping all supporting copies or all device footage indefinitely. When information is no longer needed for a lawful purpose, it should be deleted or irreversibly anonymised. Backup copies may remain until the relevant backup cycle replaces them, subject to appropriate protection and restrictions on use.

You may ask for the retention period or criteria applicable to a particular record. A deletion request is assessed against the legal grounds for retaining the information concerned; we will explain any applicable restriction or exception.

12. Security

We are responsible for taking appropriate technical and organisational measures for the information we process, proportionate to the risks and applicable law. Access should be restricted to authorised people who need it for their duties, and providers must be selected and used with appropriate safeguards. No transmission or storage method can be guaranteed completely secure; this does not remove our legal responsibilities. If you suspect misuse of information connected with our services, contact legal@smartstay.me.

13. Children and information supplied by others

Our booking and business services are intended to be arranged by adults with the required authority. We may need information about children staying with an adult for registration, safety or the provision of the stay. It should be supplied by a parent, guardian or another properly authorised adult, with any consent or verification required by law. We do not ask children to enter a booking contract independently. Contact us if a child's information has been supplied incorrectly or without the required authority.

14. Your rights and how to contact us

Depending on the applicable law and circumstances, you may have rights to obtain information and access your personal data; correct inaccurate information; request deletion; restrict or object to processing; receive or transfer data in a portable form; withdraw consent; and seek human review of relevant automated decisions. You can object to direct marketing at any time.

Send requests to legal@smartstay.me. Include enough information to identify the relevant relationship or record, such as a booking reference, and tell us what you are requesting. We may ask for proportionate information to verify identity or authority and protect other people's information. Do not send a full passport copy or payment-card details in an initial request unless we ask through an appropriate secure route.

We will handle requests within the period required by the applicable law. Where EU or UK GDPR applies, this is generally one month, subject to lawful extensions or other adjustments, which we will explain where relevant. We do not routinely charge for exercising rights; any refusal, restriction or fee must be permitted by the applicable law and will be explained.

You may complain to the competent data-protection authority without first being required to complain to us. This may include the UAE Data Office or other competent UAE authority and, where applicable, the UK Information Commissioner's Office or the relevant European supervisory authority. We would also welcome the opportunity to address your concern directly.

15. Changes to this policy

We may update this policy to reflect changes in our services, practices or legal requirements. The version and effective date identify the published policy. We will provide additional information and obtain fresh consent where the law requires it. An update does not retrospectively authorise a previously unlawful use of information or replace consent where consent is required.