Effective Date: Sep, 2025
Last Updated: Sep, 2025
Universal Travels & Tourism LLC, also known as “Musafirt” (“we, “us,” or”our “), incorporated in Tower 400, Al Soor, Sharjah, United Arab Emirates is committed to protecting your privacy. We operate as a data processor for corporate travel management services, acting solely under the instructions of our corporate clients (data controllers) to provide services such as flight and hotel bookings, tour packages, expense management, and related experiences through our website (business.musafir.com), mobile apps, customer service channels, and partners. This Privacy Policy explains how we process personal information on behalf of our corporate clients in compliance with the UAE Personal Data Protection Law (PDPL, Federal Decree-Law No. 45 of 2021) and, where applicable, the EU General Data Protection Regulation (GDPR). This policy applies to personal data processed for corporate clients, their employees, or authorized travelers.
By using our services, you acknowledge the practices described herein as instructed by the data controller (your employer or corporate client). If you have concerns, please contact your employer or the data controller.
1. Our Role as Data Processor
Musafir acts solely as a data processor under the instructions of our corporate clients, who are the data controllers determining the purposes and means of processing your personal information. We process data to fulfill travel-related services as directed, such as booking management or expense tracking. For specific details on data processing purposes, legal bases, or your rights, please refer to your employer’s privacy policy or contact their data protection officer.
2. Information We Process
We process personal information on behalf of corporate clients to deliver travel services. “Personal Information” means data that identifies or relates to you as an individual, as provided or instructed by the data controller.
Information Provided by Corporate Clients:
- Employee or Traveler Data: Name, email, phone, address, date of birth, gender, travel preferences (e.g., meal requests, seating, frequent flyer info), emergency contacts, and details of authorized companions (provided with consent by the controller).
- Corporate Details: Company information, employee data for travel or expense management, or business card submissions.
Information Collected Automatically (Under Controller Instructions):
- Device and Usage Data: IP address, browser type, screen resolution, pages visited, search terms, and app interactions (e.g., trips viewed, bookings made).
- Geolocation: Approximate location via IP or device for features like nearby hotels (only if instructed); precise location only with explicit consent from the controller.
- Log Data: Referral sources, crash reports, and cookie information (as directed).
Information from Other Sources:
- Third Parties: Updated contact details from partners or verification data from fraud prevention services, as instructed by the controller.
- We do not process sensitive payment details (e.g., full credit/debit card numbers). Payments are handled securely via third-party payment gateways, and we may process limited data (e.g., transaction IDs) as directed for booking purposes.
3. How We Process Your Information
We process personal information strictly under the instructions of the corporate client (data controller) for the following purposes:
- Service Delivery: Process bookings, manage travel arrangements, handle payments via secure gateways, provide customer support, and fulfill travel requests (e.g., sharing with airlines/hotels as instructed).
- Personalization and Features: Recommend trips, track expenses, or manage rewards programs, as directed.
- Communications: Send confirmations, updates, or alerts, as instructed by the controller.
- Business Operations: Analyze trends, improve services, detect fraud, ensure security, or create aggregated reports (no personal identifiers), as per controller agreements.
- Marketing: Only if instructed by the controller, tailored ads or emails (opt-out via controller’s mechanisms).
Processing is based on the legal bases determined by the data controller (e.g., contractual necessity, consent, or legitimate interests), as outlined in their privacy policy.
4. Sharing and Disclosure of Your Information
We share personal information only as instructed by the corporate client and with appropriate safeguards. We do not sell personal information.
- Within Musafir: With affiliates for operational support, as directed.
- Service Providers: Third parties for hosting, payment processing (via secure gateways), or analytics, under processor agreements.
- Travel Partners and Suppliers: Airlines, hotels, tour operators, or global distribution systems (e.g., Amadeus) to complete bookings, as instructed; refer to their privacy policy.
- Corporate Clients: Relevant employee or traveler data shared with the controller (your employer) for travel management.
- Legal and Business Needs: In response to laws, subpoenas, or to protect rights/safety, as instructed; during mergers or acquisitions; or for aggregated data with partners, as directed.
5. Cookies and Tracking Technologies
We use cookies, pixels, and similar tools as instructed by the corporate client for functionality (e.g., preferences), analytics, or ads. Our Cookies Policy (business.musafir.com) provides details. Third-party advertisers may use tracking for ads, as directed; opt out via tools like https://www.google.com/settings/ads or http://optout.aboutads.info. Refusing cookies may limit features, manageable via browser settings or as per controller instructions.
6. Data Security
We implement reasonable safeguards, including 256-bit SSL encryption, firewalls, access controls, and employee training, to protect data as per controller agreements. Payments are processed through secure third-party gateways; we do not store payment details. Our liability is limited to the value of services provided, as agreed with the controller.
7. International Data Transfers
As a UAE-based processor, we primarily store data in the UAE or in secure regions. For global services, data may be transferred to affiliates or partners in the EU, US, or elsewhere, as instructed by the controller. We use safeguards like standard contractual clauses (SCCs) to ensure protection compliant with PDPL and GDPR. Transfers are conducted under the controller’s agreements.
8. Your Rights and Choices
As a processor, we facilitate data subject rights as instructed by the corporate client (data controller). Under PDPL and GDPR, you may have rights to:
- Access, correct, update, or delete your information.
- Object to or restrict processing (e.g., marketing).
- Withdraw consent or request portability.
To exercise these, contact your employer’s data protection officer or refer to their privacy policy. For cookies or ads, opt out via browser settings or links provided.
9. Children’s Privacy
Our services are not directed at children under 18. If we process such data without controller consent, we will delete it promptly, as instructed.
10. Data Retention
We retain personal information only for the duration specified by the corporate client, typically aligned with travel service delivery or legal requirements (e.g., 7 years for booking records under UAE law). Data is deleted or anonymized thereafter, as instructed.
11. Data Breach Notification
In case of a data breach, we will notify the corporate client immediately (per PDPL) or within 72 hours (per GDPR, if applicable), as instructed, to enable controller notifications to authorities or data subjects.
12. Changes to This Policy
We may update this policy to reflect changes in practices or laws, as directed by controllers. Updates will be communicated via email, website notice, or app alerts, as instructed. Continued use of services constitutes acceptance under controller guidance.
13. Contact Us
For questions or requests, contact your employer’s data protection officer. Alternatively, reach us at:
Universal Travels & Tourism LLC, (Musafir)
Address:Tower 400, Al Soor, Sharjah,United Arab Emirates
Email: dpo@musafir.com
Phone: +971 (6) 516-6600