Legal
Privacy Policy
What we collect, why we need it, who else touches it, and how to get it back or have it deleted. We ask for the minimum needed to run an experience and put you in the right group, nothing more. We do not sell your data, and we never will.
On this page
- 1. Who is responsible
- 2. What we collect
- 3. What we never collect
- 4. Why we are allowed to use it
- 5. Who else processes it
- 6. Your card details
- 7. WhatsApp groups
- 8. Marketing messages
- 9. Photos and video
- 10. How long we keep it
- 11. Your rights
- 12. How we protect it
- 13. International transfers
- 14. Cookies and tracking
- 15. Under-18s
- 16. Changes to this policy
- 17. Contact and complaints
1. Who is responsible for your data
The data controller is Registered company name: available on request at romain@worldxpat.com, trading as WorldXpat, licensed in Dubai, United Arab Emirates under commercial licence Trade licence number and issuing authority: available on request at romain@worldxpat.com, registered at Registered address in Dubai: available on request at romain@worldxpat.com. Full details on the Legal Notice page.
For anything about your personal data, write to romain@worldxpat.com. A real person reads it.
We apply the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Many of our participants come from Europe and the UK, so we give the same access, correction, deletion and portability rights to everyone, wherever you live.
2. What we collect, and exactly why
| What | Why we need it | When |
|---|---|---|
| First name and last name | To know who is coming, welcome you by name, and manage the guest list. | At booking |
| Email address | Your confirmation, your receipt, your personal booking link, and service messages about your reservation. | At booking |
| Phone number (WhatsApp) | To send you the meeting point and time privately a few days before, and to add you to your group chat. | At booking |
| Date of birth | No longer collected. We used to ask for it at booking. Dates given before 27 July 2026 are still on file and can be erased on request. | Not collected |
| Marketing consent (optional yes / no) | Only recorded so we know whether you agreed to hear about future experiences. | At booking, if you tick the box |
| Your booking record: experience, date, amount, status, moves and refunds | To run your reservation, account for it, and handle any dispute. | Throughout |
| Payment references from Stripe: customer and payment identifiers, card brand, last 4 digits | To charge the balance when your group is confirmed, to issue refunds, and to resolve disputes. | At payment |
| Photos and video from events | To show what WorldXpat is really like, unless you opt out. | On the day |
| Basic technical data: IP address, browser type, timestamps in server logs | Security, fraud prevention and keeping the site working. | When you visit |
That is the complete list. If we ever need something else, we will ask you and tell you why.
3. What we never collect
- Your full card number, expiry date or security code. They go from your browser straight to Stripe and never reach us.
- Copies of your passport or Emirates ID. We do not need them to take a booking.
- Health information, unless you volunteer it so we can look after you on the day.
- Data bought from third parties. Everything we hold, you gave us yourself.
We never sell, rent or trade your personal data. Not to advertisers, not to partners, not to anyone. It exists to run your experience.
4. Why we are allowed to use it
- To perform our contract with you: your name, email, phone and booking record exist because you asked us to reserve you a spot.
- Your consent: marketing messages, and the use of photos where you are identifiable. You can withdraw either at any time.
- Our legitimate interest: running safe, well-matched groups, preventing fraud and abuse, and improving our experiences.
- Legal obligations: keeping accounting and tax records as required in the UAE, and responding to lawful requests from authorities.
6. Your card details
We never see, receive or store your full card number. Payment happens on a page hosted by Stripe. What comes back to us is a reference, plus the brand of your card and its last four digits.
When an experience has a balance still to pay, Stripe stores your card so we can charge that balance later, on the strength of the authorisation you give at booking. That authorisation covers one charge, of one fixed amount, for one date, and only if that date is confirmed. It is not a subscription and it cannot be used for anything else. The full explanation is in the Reservation Terms, section 5.
Once your booking is finished and any legal retention period has passed, the stored card reference is deleted along with the rest of your record.
7. WhatsApp groups · please read this bit
When your date is confirmed we invite you to a WhatsApp group with the other participants. It is where the crew actually forms, and it is optional.
If you join, your phone number and your WhatsApp display name and photo become visible to everyone else in that group. We cannot change that: it is how WhatsApp works. You can leave a group at any time.
Meta processes anything shared in WhatsApp under its own terms and privacy policy, which we do not control. If you would rather not be in a group, tell us and we will send you the practical details by email instead.
8. Marketing messages
We only send you news and offers if you ticked the optional box when booking. It is genuinely optional. Your reservation works exactly the same either way.
You can stop them at any time: use the unsubscribe link in any marketing email, reply STOP on WhatsApp, or email romain@worldxpat.com. We action it immediately.
Withdrawing marketing consent does not stop the service messages about a booking you have actually made (your confirmation, your receipt, the meeting point) because those are part of the experience you paid for.
9. Photos and video
We photograph and film our experiences, and we may publish those images on our website, on Instagram and in our community channels.
You can opt out at any time, before, during or after an event. Tell a host on the day or email romain@worldxpat.com. We will not publish images in which you are identifiable, and we will remove existing ones on request. We do not ask why.
10. How long we keep it
- Booking and payment records: kept for as long as UAE accounting and tax rules require (generally 5 years from the end of the relevant financial period) so we can account for the transaction and defend a dispute or chargeback.
- Contact details for marketing: until you withdraw consent. After that we keep a minimal suppression record (your email, nothing else) so we never contact you again by mistake.
- Photos and video: until you ask us to remove them.
- Server logs: kept briefly by our hosting providers, typically a few weeks, then deleted automatically.
- Anything we no longer need is deleted or irreversibly anonymised.
11. Your rights over your data
Whatever passport you hold, you can ask us to:
- Access: get a copy of everything we hold about you.
- Correct: fix anything wrong or out of date.
- Delete: erase your data, subject to records we are legally obliged to keep.
- Port: receive your data in a common, machine-readable format so you can take it elsewhere.
- Restrict or object: ask us to stop a particular use of your data, including profiling for marketing.
- Withdraw consent: for marketing or for photos, at any time, with no consequence for your bookings.
How to exercise any of them: email romain@worldxpat.com from the address you booked with, saying what you want. It is free.
We reply within 30 days. We may ask you one question to confirm it is really you. If we have to keep something for a legal reason, we will tell you exactly what and why.
For everyday changes you do not even need us: the personal link in your confirmation email lets you move or refund your booking yourself, with no account to create.
12. How we protect it
- The whole site is served over HTTPS, and payment happens on Stripe's own secure page.
- Our bookings table is not readable from the public website. Only our secure server functions and the account owner can read it.
- Managing a booking uses a private, single-use link tied to that one reservation: no password to leak, and no access to anyone else's data.
- Access to personal data is limited to the people who genuinely need it to run the experiences.
No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant authority as required by law, and tell you plainly what happened.
13. International transfers
Our service providers operate outside the United Arab Emirates, including in the European Union and the United States, which means your data is processed abroad. We only use established providers that commit contractually to appropriate safeguards and to processing your data solely on our instructions.
15. Under-18s
Our experiences are strictly for adults, 18 and over. We do not knowingly collect data about anyone younger. If we learn that we have, we delete it immediately.
16. Changes to this policy
We update this page when our tools or our processes change. The date at the top always tells you when it last changed. If a change materially affects how we use your data, we will tell you directly, by email.
17. Contact and complaints
Email: romain@worldxpat.com. Put "Privacy request" in the subject line and we will handle it as a priority.
Phone: please reach us at romain@worldxpat.com
Address: Registered address in Dubai: available on request at romain@worldxpat.com
If you are not happy with how we have handled your data, tell us first. We would rather put it right. You also have the right to complain to the competent data protection authority in the United Arab Emirates, or to the supervisory authority in your country of residence.
See also our Reservation Terms & Conditions, our Cancellation & Refund Policy and the Legal Notice.