This policy explains what personal data we collect when you contact us, ask about a stay, or stay with us. It covers why we collect it, how long we keep it, who else handles it, and the rights you have under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
1. Who we are
Casa Duna Property Management L.L.C – S.P.C (“Casa Duna”, “we”, “us”) is the data controller for the personal data described here.
- Abu Dhabi DCT Holiday Home Permit: PER25000250
- Address: Water’s Edge, Building 4, Unit 721, Yas Island, Abu Dhabi, UAE
- Contact for privacy matters: casaduname@gmail.com or WhatsApp +971 58 580 2785
2. What we collect
2.1 Enquiry and booking request data
If you send us a booking request or an enquiry through casaduna.ae or WhatsApp, we collect your name, email address, phone number, the dates and number of guests you are asking about, anything you choose to tell us about your trip, and a record that you accepted this policy and our booking terms at the time you sent the request.
2.2 Booking and contact data
If a stay goes ahead: your country of residence, confirmed dates, the number and names of guests, and your messages with us.
2.3 Identity documents, for every guest
Passport or Emirates ID details and a copy, including document number, nationality, date of birth, gender, issue and expiry dates, and place of issue. Where identity verification is used, this may include a facial image and liveness check to confirm the document belongs to you.
We collect this for every guest staying at the property, not only the person who books. UAE law requires this of us (see 3.2).
2.4 Payment data
We do not take card payments on this website, and a booking request does not ask for card details. If a stay is confirmed, we agree payment with you directly and tell you at that point exactly how it will be taken. Where a payment is handled by a payment provider, that provider receives the card details directly and we keep only the reference, amount, date and outcome. We never store full card numbers.
2.5 Stay and security data
Check-in and check-out times, access-code issue and use timestamps, vehicle registration if you register for parking, property condition and turnover photographs, and records of any damage or incident.
2.6 Website data
Basic technical data (IP address, device and browser type, pages viewed) and the cookies described in section 9.
3. Why we use it, and our legal basis
| Purpose | Legal basis under the PDPL |
|---|---|
| To answer your enquiry, and to take, confirm and manage a booking | Performance of a contract with you, and steps taken at your request before one exists |
| To register every guest with Abu Dhabi DCT and make records available to the authorities | Compliance with a legal obligation |
| To verify each guest’s identity before issuing access | Legal obligation, and our legitimate interests |
| To take payment for a confirmed stay and handle any damage claim | Performance of a contract, and legitimate interests |
| To prevent fraud and misuse, and to defend disputes | Legitimate interests, and establishing or exercising legal claims |
| To keep tax, tourism-fee and accounting records | Legal obligation |
| To send you service messages about your stay | Performance of a contract |
| To send you offers or updates, only if you ask us to | Your consent, which you can withdraw at any time |
3.2 On the legal obligation. As a DCT-licensed holiday-home operator we are required to record the identity of every guest staying at the property, and to provide guest records to the Abu Dhabi Department of Culture and Tourism and other competent authorities on request. We cannot host you without this, which is why identity verification is a condition of check-in.
3.3 We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects for you.
4. Who else handles your data
4.1 Chekin, our identity-verification provider. Chekin processes guest identity documents and biometric verification on our behalf, as our processor, under a data-processing agreement, and is used to meet our guest-registration duty.
4.2 Our booking and payment providers. Where we use a reservation system or a payment provider for a confirmed stay, it handles that booking or payment on our instructions. Card data goes to the payment provider directly. We will name the provider to you at the time.
4.3 Booking platforms. If you booked through Airbnb, Booking.com or Vrbo, that platform handles your data under its own privacy policy as well as this one.
4.4 Government authorities, including the Abu Dhabi Department of Culture and Tourism, the police and the tax authority, where we are legally required to report or produce guest records.
4.5 Building management and security, where the building requires guest or vehicle details for access, parking or security.
4.6 Our hosting, email and messaging providers, which store the messages and records described above on our behalf.
4.7 Professional advisers and insurers, where necessary to handle a claim, dispute or legal matter.
4.8 We do not share your data with anyone else for their own marketing purposes.
5. International transfers
Some of our providers may process data outside the UAE. Where that happens we only use providers that offer an adequate level of protection, that are bound by contract to protect your data to a standard consistent with the PDPL, and that process it only on our instructions.
6. How long we keep it
| Data | Retention |
|---|---|
| Guest identity documents (passport or Emirates ID copies) | 12 months after check-out, then securely deleted, unless a longer period is required by DCT or another authority, or the records are needed for an ongoing dispute, claim or investigation |
| Enquiries and booking requests that do not become a stay | 12 months, then deleted |
| Booking, tax and tourism-fee records | As required by UAE tax and licensing law, currently 5 years |
| Payment and transaction records | 5 years |
| Damage or incident records and evidence | Until the matter is resolved, then up to 12 months |
| Marketing consent records | Until you withdraw consent |
We delete or securely anonymise data once it is no longer needed for the purpose it was collected for.
7. How we protect it
We use appropriate technical and organisational measures. Access is restricted on a need-to-know basis, identity documents are transmitted encrypted through our verification provider, records are held in access-controlled systems, and we do not keep full card data on our own systems. We keep our access lists and retention practices under review.
If a personal-data breach occurs that poses a risk to your privacy, we will notify the UAE Data Office and the affected individuals as the PDPL requires.
8. Your rights
Under the PDPL you have the right to:
- be informed about how your data is used, which is what this policy is for;
- access the personal data we hold about you and ask for a copy;
- have inaccurate or incomplete data corrected;
- ask us to delete your data, subject to our legal duty to keep guest records for DCT and tax purposes;
- restrict or object to certain processing, including processing based on our legitimate interests;
- ask for the data you gave us in a structured, machine-readable format;
- withdraw consent at any time where processing is based on consent, for example marketing. This does not affect processing already carried out;
- complain to the UAE Data Office if you believe your data has been handled unlawfully.
To exercise any of these, email casaduname@gmail.com or WhatsApp +971 58 580 2785. We will respond within the period the law requires. We may need to verify your identity first, which is appropriate given what we hold.
Please note: we cannot delete guest identity records while we are legally required to keep them for DCT compliance. We will tell you if that applies, and delete them once the period ends.
9. Cookies
casaduna.ae uses only the cookies needed to make the site work and to understand basic, aggregated usage. We do not use cookies to build advertising profiles of you. If we ever use a non-essential cookie we will ask your consent first, and you can decline without losing access to the site.
10. Children
The property is booked by adults, and the lead guest must be 21 or over. We collect identity data for children only because they are staying as part of a party and the law requires every guest to be registered. That data is handled exactly as described above, and is provided by the accompanying adult, who confirms they are authorised to provide it.
11. Changes to this policy
We may update this policy. The current version is always here on casaduna.ae, with the “last updated” date at the top. If we make a significant change to how we use your data, we will tell guests who have an active or upcoming booking.
12. Contact
Casa Duna Property Management L.L.C – S.P.C
Water’s Edge, Building 4, Unit 721, Yas Island, Abu Dhabi, UAE
Email: casaduname@gmail.com · WhatsApp: +971 58 580 2785
DCT Holiday Home Permit PER25000250
See also our Terms & Conditions.