1. Who we are
This Privacy Policy explains how Rexer Group L.L.C-FZ (“Rexer,” “we,” “us,” or “our”), a company registered in Meydan Free Zone, Dubai, United Arab Emirates, collects, uses, shares, and protects personal data in connection with the Rexer mobile application and related services (the “Platform”).
Rexer is the data controller for the personal data described in this Policy, except where stated otherwise. This Policy applies to riders who use the Platform to book trips, and to drivers and RTA-licensed limousine operators (“Operators”) who provide trips through the Platform.
Rexer is a technology intermediary connecting riders with RTA-licensed limousine Operators and their drivers. Rexer is not a transport operator and does not employ drivers.
2. Data we collect
We separate this section by who the data relates to, and describe each in plain categories consistent with how this data is reported to Apple App Store and Google Play Store.
2.1 Riders
We collect the following categories of data about riders who use the Platform:
| Category | What we collect | How we collect it |
|---|---|---|
| Personal info | Name, mobile phone number, email | Provided directly by the rider at registration |
| Financial info | Payment method details (tokenised by Stripe; Rexer does not store raw card numbers), wallet (Rexer Pass) balance and transaction history | Provided directly by the rider via Stripe; generated by the Platform during use |
| Location | Pickup and drop-off location, live trip route, during an active trip only | Collected directly from the rider's device, with permission, during trip booking and active trips |
| App activity | Trip history, in-app support messages, ratings given to drivers, app interaction and crash diagnostics | Generated by the Platform during use |
| Identifiers | Device identifier, mobile OTP verification record | Generated during account verification via Message Central |
Riders do not undergo identity document verification of any kind. Rider verification is limited to mobile number confirmation via one-time passcode (OTP) and addition of a valid payment method.
2.2 Drivers
Rexer does not collect driver data directly from drivers in the current phase of the Platform. Instead, the RTA-licensed limousine Operator engaging the driver submits the following on the driver's behalf:
| Category | What is collected | Source |
|---|---|---|
| Personal info | Driver name, Emirates ID details, contact information | Submitted by the Operator |
| Government ID | Emirates ID document, RTA driving permit / driver card | Submitted by the Operator |
| Vehicle info | Vehicle registration, commercial insurance certificate, vehicle class assignment | Submitted by the Operator |
| App activity | Trip records, location during active trips, ratings received from riders | Generated by the Platform during use |
Because this data is submitted to us by the Operator rather than directly by the driver, see Section 4.2 (Indirect collection of driver data) below for how we handle this and what rights the driver has.
2.3 Information we do not collect
We do not collect identity documents from riders.
We do not collect biometric data (facial recognition, fingerprints, or similar) from riders or drivers.
We do not record audio during trips.
We do not collect location data outside of active trip use.
3. How we use data
We use personal data for the following purposes, each with the lawful basis indicated:
| Purpose | Lawful basis |
|---|---|
| Creating and managing rider and driver/vehicle profiles | Contractual necessity |
| Matching riders with available drivers and calculating fares | Contractual necessity |
| Processing payments and wallet (Rexer Pass) transactions | Contractual necessity |
| Trip safety, fraud prevention, and dispute resolution | Legitimate interest |
| Customer support and complaint handling | Contractual necessity / legitimate interest |
| Regulatory recordkeeping and cooperation with RTA requirements | Legal obligation |
| Marketing communications (e.g. promotions, new features) | Consent — opt-in, withdrawable at any time |
| Service improvement and aggregated analytics | Legitimate interest |
We do not use location data, trip history, or any other personal data for behavioural advertising or to build advertising profiles.
4. Who we share data with
We share personal data only with the specific third parties listed below, each engaged to provide a defined function of the Platform. We do not sell personal data to any third party.
| Third party | Purpose | Data involved |
|---|---|---|
| Stripe | Payment processing (PCI-DSS Level 1 certified) | Payment method details, transaction amounts |
| Google Maps Platform | Routing, geocoding, navigation, fare distance calculation | Pickup/drop-off location, route data |
| Message Central | SMS one-time passcode (OTP) delivery for account verification | Mobile phone number |
| RTA-licensed limousine Operators | Driver/vehicle onboarding and trip fulfilment | Driver and vehicle documents; trip assignment data |
| RTA (Roads and Transport Authority) | Regulatory compliance and recordkeeping, where legally required | Trip records, as required by applicable regulation |
Each third party listed above is contractually required to provide a level of protection for personal data consistent with this Policy, and is permitted to use the data only for the stated purpose.
4.1 Hosting and data residency
All personal data collected through the Platform is hosted on servers located within the United Arab Emirates. We do not transfer personal data outside the UAE.
4.2 Indirect collection of driver data
Driver personal data described in Section 2.2 is submitted to Rexer by the relevant RTA-licensed limousine Operator, not by the driver directly. Our Driver & Operator Terms require each Operator to:
Inform the driver, before submission, that their personal data will be shared with and processed by Rexer for the purpose of enabling the driver's use of the Platform;
Obtain the driver's valid consent to that submission and processing;
Notify Rexer if a driver withdraws consent or disputes the accuracy of submitted data.
Regardless of how their data was first collected, drivers may contact us directly using the details in Section 10 to exercise any of the rights described in Section 7.
5. International transfers
We do not transfer personal data outside the United Arab Emirates. All data processing and storage occurs on UAE-hosted infrastructure.
6. Data retention
| Data type | Retention period |
|---|---|
| Trip and transaction records | As per regulation requirements |
| Rider account data | For the duration of the account, plus any period required by law after deletion |
| Driver and vehicle documents | For the duration of the driver's or vehicle's active status on the Platform, plus any period required by RTA recordkeeping requirements or the Operator Agreement |
| Location data | Collected and used only for the duration of an active trip; not retained for profiling purposes beyond the trip record |
7. Your rights
Subject to applicable law, you have the right to:
Access a copy of the personal data we hold about you;
Correct inaccurate or incomplete personal data;
Request deletion of your personal data, subject to legal or contractual retention obligations;
Receive your personal data in a structured, commonly used format (data portability);
Object to processing based on legitimate interest;
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Response timeframes: access requests are fulfilled within 30 days; correction requests within 7 days; deletion requests within 30 days, subject to retention obligations described in Section 6.
7.1 How to exercise your rights
Riders and drivers can access, correct, export, or delete their personal data, directly within the Platform via the in-app privacy dashboard (Settings > Privacy). Account deletion is also available directly within the app and sent to support.
You may also exercise any of these rights by contacting us using the details in Section 10.
7.2 Rexer Pass (wallet) balances on account deletion
If your Rexer Pass wallet balance is AED 50 or more at the time of account deletion, you may request a refund of the remaining balance before deletion completes. Balances below AED 50, and any promotional or bonus credit regardless of amount, are non-refundable and are forfeited upon account deletion. Full wallet terms are set out in the Rexer Pass Terms & Conditions.
8. Children's privacy
The Platform is not directed at, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor without appropriate consent, we will take steps to delete that data.
9. Security
We apply industry-standard security measures to protect personal data, including encryption of data in transit, access controls limiting data access to authorised personnel, and regular review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
In the event of a data breach likely to result in a risk to your rights, we will notify affected individuals without undue delay and in accordance with applicable law.
10. Governing law and disputes
These Terms are governed by the laws of the United Arab Emirates. Any dispute arising from or relating to these Terms shall be subject to the exclusive jurisdiction of the competent courts of Dubai, without prejudice to any RTA-mandated dispute or complaints process applicable to licensed limousine operators.
11. Contact us
If you have questions about this Privacy Policy, or wish to exercise any of the rights described above, you can contact us at:
Email: support@rexer.group
Postal address: Rexer Group L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates
12. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified in-app or by email before taking effect. The “Effective date” at the top of this Policy indicates when it was last updated.