Privacy Policy

01Introduction

This Privacy Policy explains how [Garaji Legal Entity Name] (trade licence no. [INSERT]), a company registered in [Emirate], United Arab Emirates ("Garaji", "we", "us", or "our"), collects, uses, shares, and protects your personal data when you use the Garaji mobile application, the website at garajiae.com, and any related services, including the Makanik AI assistant (together, the "Service").

We are the data controller responsible for your personal data under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations, as in force from time to time (the "PDPL"). By creating an account or using the Service, you confirm that you have read and understood this Policy. Where we rely on your consent, we will ask for it separately and clearly.

02Scope

This Policy applies to all users of the Service who are individuals residing in, or whose personal data is processed in, the United Arab Emirates. It does not apply to third parties we link to or work with, such as garages, parts sellers, or payment providers, who operate under their own privacy policies.

03Key definitions

In this Policy, "Personal Data" means any data relating to an identified or identifiable natural person; "Sensitive Personal Data" means data revealing matters such as health, biometric data, ethnic origin, or religious or political beliefs; "Processing" means any operation performed on Personal Data; and the "Office" means the UAE Data Office. These terms carry the meanings given to them in the PDPL.

04The personal data we collect

Account and identity data: your name, email address, mobile number, password (stored encrypted), and profile details.

Vehicle data: details of your vehicle, including make, model, year, and mileage, so the Service can give vehicle-specific assistance.

Interaction and diagnostic data: the symptoms, questions, descriptions, messages, and feedback you submit to Makanik and other features, together with the responses and diagnoses generated and any ratings you give.

Location data: your approximate or precise location, where you enable it, so we can match you with nearby garages and parts. You can disable this in your device settings, though some features may not work without it.

Booking and transaction data: records of bookings, booking references, parts enquiries, purchases, and credit-pack transactions. Payment-card details are handled directly by our payment processor and are not stored by Garaji.

Community content: posts, comments, replies, and images you choose to share, which may be visible to other users.

Usage and device data: how you use the Service and the device you use, including device identifiers, operating system, app version, log data, and crash information.

We do not intentionally collect Sensitive Personal Data. Please do not submit Sensitive Personal Data to Makanik or the community.

05How we collect personal data

We collect Personal Data directly from you (when you create an account, set up your vehicle, interact with Makanik, post in the community, book, or contact us); automatically (through your use of the Service, using device identifiers and analytics); and from third parties (such as a garage confirming a booking, or service providers who help us operate the Service).

06Why we process your personal data, and our legal basis

Under the PDPL we process Personal Data only where we have a lawful basis: your consent (for example, location access and marketing, which you may withdraw at any time); performance of a contract with you (to provide the features you request, process bookings and credits, and support you); compliance with our legal obligations; and other lawful bases permitted by the PDPL, such as protecting vital interests or defending legal claims.

We process your data to provide and personalise the Service and Makanik's assistance; generate diagnostics, estimates, and accident guidance; match you with garages and parts and facilitate bookings; operate and moderate the community; process transactions; communicate with you; keep the Service secure; improve the Service and our AI models; comply with law; and prevent fraud and abuse.

07Artificial intelligence and improvement of our models

The Service is powered by AI, including Makanik. To operate, evaluate, and improve the accuracy, safety, and quality of the Service, we may process your interaction and diagnostic data, and may use it in de-identified or aggregated form to train, fine-tune, test, and improve our AI models and the Service.

Where we rely on your interaction data for model improvement beyond what is necessary to provide the Service to you, we do so on the basis of your consent or another lawful basis under the PDPL. You may object to or opt out of this use through your account settings or by contacting us, without affecting your ability to use the core Service.

08Automated processing and the limits of AI diagnoses

Makanik uses automated processing to generate diagnoses, severity ratings, cost estimates, and guidance. These outputs are informational estimates only. They are not a professional inspection, not medical or safety advice, and not a substitute for a qualified mechanic or, in an emergency, the relevant authorities. You remain responsible for decisions about your vehicle and safety. You have the right to request human review of, or object to, automated processing that produces legal or similarly significant effects, to the extent provided by the PDPL.

09How we share your personal data

We do not sell your Personal Data. We share it only as follows.

Garages and parts sellers: when you book a service or enquire about a part, we share the data needed to fulfil your request (such as vehicle details, the relevant diagnosis summary, your booking reference, and contact details). These parties act as independent controllers once the data is shared.

Payment processors: payments and credit-pack purchases are processed by third-party providers (for example, [INSERT]) under their own terms. We do not store full payment-card details.

Service providers: we use trusted providers for hosting, database, analytics, communications, content moderation, and AI services. They process data on our behalf under contracts requiring safeguards consistent with the PDPL.

Legal and safety: we may disclose data where required by UAE law or a competent authority, or to protect the rights, safety, or property of Garaji, our users, or others.

Business transfers: in a merger, acquisition, financing, or sale of assets, data may be transferred as part of that transaction, subject to this Policy and applicable law.

10International transfers of personal data

Some service providers may process Personal Data outside the UAE. Where we transfer data abroad, we do so only in accordance with the PDPL: to jurisdictions recognised as adequate, under contractual safeguards meeting PDPL requirements, with your explicit consent, or where otherwise necessary and permitted (such as to perform a contract with you). Contact us for more information about the safeguards we apply.

11Your rights

Subject to the conditions and exceptions in the PDPL, you have the right to access your data and obtain a copy; request rectification of inaccurate or incomplete data; request erasure; request that we restrict or stop processing in certain circumstances; object to processing, including direct marketing and certain automated processing; request portability of data you provided, in a machine-readable format; and withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect processing carried out before withdrawal.

You also have the right to lodge a complaint with the UAE Data Office if you believe your rights have been infringed.

12How to exercise your rights

To exercise any of these rights, contact our Data Protection Officer at [dpo@garajiae.com]. We will respond within the period required by the PDPL. We may need to verify your identity first, and certain requests may be subject to legal exceptions, which we will explain to you.

13Data retention

We retain Personal Data only as long as necessary for the purposes in this Policy: while your account is active and thereafter as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. De-identified and aggregated data, which can no longer be linked to you, may be retained for longer. When data is no longer needed, we securely delete or anonymise it.

14Security

We apply appropriate technical and organisational measures to protect Personal Data, including encryption in transit and at rest where appropriate, access controls, and ongoing monitoring. No system is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your account credentials confidential.

15Personal data breaches

In the event of a Personal Data breach that may pose a risk to your privacy, confidentiality, or security, we will notify the UAE Data Office and, where required, affected users, in accordance with the PDPL and within the timeframes it specifies.

16Children

The Service is intended for users aged 18 and over. We do not knowingly collect Personal Data from anyone under 18. If you believe a minor has provided us with Personal Data, please contact us and we will take appropriate steps to delete it.

17Cookies and similar technologies

Our website and app may use cookies and similar technologies for essential functionality, security, preferences, and analytics. Where required, we will request your consent for non-essential cookies and provide controls to manage them. You can also manage cookies through your browser or device settings.

18Third-party links and services

The Service may link to or integrate with third-party websites and services, such as garages, sellers, app stores, and payment providers. We are not responsible for their privacy practices, and we encourage you to review their policies.

19Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a revised date and, where the changes are material, provide additional notice through the Service. Your continued use after the changes take effect constitutes acceptance, except where your consent is required.

20Contact us

For questions, concerns, or requests regarding this Policy or your Personal Data, contact our Data Protection Officer at [dpo@garajiae.com], or for general privacy enquiries at [privacy@garajiae.com], or by post at [INSERT ADDRESS].

Supervisory authority: the UAE Data Office. For information on lodging a complaint, refer to the Office's official channels.