Privacy & Cookie Policy
Privacy Policy
1. Introduction
ZFORB takes your privacy seriously. This notice explains how ZFORB International FZCO and ZFORB International Private Limited (together “ZFORB”) collect, use, disclose and safeguard your personal data when you use our website, mobile application or services. It is presented separately from our Terms of Use to provide you with a clear and understandable privacy notice as required by the Digital Personal Data Protection Rules, 2025.
This policy applies globally. If you are a resident of a jurisdiction that grants additional rights (e.g., the California Consumer Privacy Act (CCPA) or Brazil’s LGPD), those rights are respected. For example, California residents have the right to opt out of the “sale” of personal information. We do not sell your personal information, but if you wish to exercise additional CCPA rights, please email privacy@zforb.com with the subject line “CCPA Request.”
2. Data We Collect
We collect the following categories of information:
• Information you provide: name, contact details, identification documents, booking preferences, membership details and payment information.
• Information generated through your use of our services: device fingerprints, browser type, operating system, IP address, geolocation, access times, pages viewed, interaction history, and cookie identifiers. We collect this technical and security data to detect fraud and protect your account.
• Information from third parties: data from hotels (e.g., guest lists), payment processors (masked card numbers and tokens), identity verification services, marketing partners and other vendors that assist us in providing our services.
• Automated Decision Data: We may use automated systems to detect fraudulent transactions and suspicious activity. These systems analyse device fingerprints, location data and purchase patterns to prevent abuse. You have the right to object to automated processing that produces legal or similarly significant effects on you.
3. How We Use Your Data
We use personal data to:
1. Facilitate bookings and fulfil our contractual obligations;
2. Administer memberships, points and customer accounts;
3. Verify identity, prevent fraud and ensure security;
4. Communicate with you about bookings, membership benefits, promotions and updates;
5. Comply with legal obligations (e.g., tax and regulatory reporting) and respond to lawful requests; and
6. Analyse usage to improve our services and personalise your experience (with consent where required).
We do not sell your personal data. We share your data only as needed to fulfil bookings (e.g., with hotels and experience partners), process payments (e.g., with Stripe, Razorpay or other PCI‑DSS compliant processors) and comply with legal obligations. Where required by law, we may share data with regulators, law enforcement or tax authorities.
4. Lawful Bases for Processing
We process your data based on one or more of the following grounds: (i) your consent, (ii) performance of a contract, (iii) our legitimate interest in providing and improving services, or (iv) compliance with legal obligations. Under the UAE PDPL, consent must be free, specific and unambiguous and may be revoked at any time. Under India’s DPDP Rules, notice and consent must be provided separately and in clear language.
Our legitimate interests include verifying your identity, preventing fraud, delivering customer service and communicating essential updates. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
5. Security Measures
We implement technical and organisational measures to safeguard data, including encryption, pseudonymisation, access controls, secure servers and regular monitoring. Our processors are contractually required to implement equivalent safeguards to prevent data breaches or unauthorised access.
6. Data Subject Rights
Depending on your jurisdiction, you have rights to:
• Access: obtain a copy of your personal data;
• Rectification: correct inaccurate or incomplete information;
• Erasure: request deletion of data when it is no longer needed or when processing is unlawful;
• Portability: request a portable copy of your data in a structured, machine‑readable format;
• Restriction/Objection: restrict or object to our processing of your data under certain circumstances;
• Withdraw consent: withdraw your consent at any time without affecting prior processing;
• Automated decision‑making: object to being subject to automated decisions or profiling; and
• Complaint: file a complaint with the UAE Data Office or the Data Protection Board of India if you believe your rights have been violated.
To exercise these rights, email us at privacy@zforb.com or submit a request through the privacy form in the app. We will verify your identity before fulfilling any request.
Residents of California may have additional rights under the CCPA, including the right to know what personal information we collect and how we use it; the right to request deletion; and the right to opt out of certain disclosures. To exercise these rights, please email privacy@zforb.com.
7. Retention and Erasure
We retain personal data only for as long as necessary to fulfil the purposes described above or to comply with legal requirements. Under the DPDP Rules, we must erase personal data when the specified purpose is no longer served and must provide notice at least 48 hours in advance. We may retain logs for at least one year for security or compliance reasons.
If you do not use your account for an extended period, we may delete or anonymise your data in accordance with data‑retention obligations. We will inform you before deleting your data.
We retain transaction records and financial information for at least five to seven years to comply with tax and accounting laws. Communications and support records may be retained for a shorter period unless needed for dispute resolution.
8. Cross‑Border Transfers
ZFORB operates globally and may transfer your data to countries outside your own. Transfers are permitted only when the destination country offers adequate protection or when appropriate safeguards (such as standard contractual clauses) are in place.
9. Children’s Privacy
We do not knowingly collect data from individuals under 18 years of age. If we become aware that a child has provided personal data without parental consent, we will take steps to delete such information. Processing children’s data under India’s DPDP Rules requires verifiable parental consent.
10. Data Breach Notification
If a personal data breach occurs, we will promptly notify affected individuals and the relevant data authority, explaining the nature of the breach, its impact and measures taken to mitigate risks.
11. Changes to This Policy
We may update this notice to reflect changes in law or business practices. The latest version will always be available on our website and app.
12. Contact
For questions or concerns about this Privacy Policy, please email privacy@zforb.com or write to our registered offices as listed in the Legal Notices.
Cookie Policy
1. What Are Cookies?
Cookies are small text files placed on your device when you visit our website or use our mobile application. They store information about your preferences and help us improve your experience. We also use similar technologies such as pixels and local storage (collectively referred to as “cookies”).
2. Types of Cookies We Use
• Essential cookies: These cookies are necessary for the operation of our website and app. They enable basic functions such as page navigation, secure log‑in and booking processing. Our services cannot function properly without them.
• Performance cookies: These cookies collect aggregated, anonymous statistics about how you use our services (e.g., which pages you visit most often) so we can improve our platform.
• Functional cookies: These cookies remember your preferences (e.g., language, currency and membership tier) to personalise your experience.
• Marketing cookies: These cookies may be set by us or third‑party partners to build a profile of your interests and show you relevant advertisements. They also help us measure the effectiveness of our marketing campaigns.
3. Cookie Consent
When you first visit our site or launch our app, a cookie banner will appear requesting your consent for non‑essential cookies. You can accept all cookies, decline all cookies, or customise your preferences. You can change your cookie settings at any time by clicking “Cookie Settings” in the footer of our website or in the app settings.
4. Do Not Track and CCPA Opt‑Out
Some browsers and devices send a “Do Not Track” (DNT) signal to websites. There is no uniform standard for responding to DNT signals, so we do not currently change our practices in response to them. We do not sell your personal information for monetary value. If you are a California resident and wish to opt out of disclosures that could be interpreted as a “sale” under the CCPA, please email privacy@zforb.com with the subject “Do Not Sell My Personal Information.”
5. Managing Cookies
Managing Cookies
Most web browsers allow you to control cookies through their settings. You can configure your browser to accept or reject cookies, or to notify you when a cookie is being set. If you block cookies entirely, some features of our services may not work properly.
Third‑Party Cookies
We may use third‑party services such as analytics providers and advertising networks that set cookies on our behalf. These providers may use cookies to deliver advertisements relevant to you or to provide aggregated statistics. We encourage you to review their privacy and cookie policies to understand how they handle your information.
Updates to This Policy
We may update this Cookie Policy from time to time. Any changes will be posted on this page, and the date of the latest revision will appear at the top. If required by law, we will request your consent again when material changes are made.
Contact
If you have questions about our use of cookies, please contact privacy@zforb.com.
Last updated: 15 December 2025