Account identifiers
01 / 04- Collected when
- When you sign up, usually via UAE Pass.
- Legal basis
- Contract. Federal Decree Law 45/2021, Art. 5.
- Stored in
- AWS me-central-1 (UAE).
- Shared with
- Sumsub, for KYC verification only.
Privacy statement
Privacy
A short, direct statement of what we do, and what we do not, with your information.
- Last updated
- 22 April 2026
- Effective
- Immediately
- Reading time
- Four minutes
We collect the minimum to run the auction, never sell your data, and delete it when you ask.
§ 01 · What we do not do
22.04.2026
We never sell. We never track you across sites. We never reveal bids. We always delete when you ask.
- L.01We never sell your personal data to advertisers, data brokers, or any third party.
- L.02We do not place third party advertising pixels on our site or in our app.
- L.03We never reveal bidder identities to sellers, or to other bidders, at any stage of an auction.
- L.04We honour deletion requests within thirty days, except where UAE law requires longer retention.
§ 02 · What we collect
22.04.2026
Four categories. No more than what is needed. All of them listed here.
Transaction data
02 / 04- Collected when
- When you bid, pay, or consign a vehicle.
- Legal basis
- Contract and legitimate interest in fraud prevention.
- Stored in
- AWS me-central-1 (UAE).
- Shared with
- CBUAE licensed bank partner for escrow settlement.
Listing data
03 / 04- Collected when
- When you consign a vehicle: VIN, plate, odometer, photos.
- Legal basis
- Contract; consumer protection (Federal Law 15/2020).
- Stored in
- AWS me-central-1 (UAE).
- Shared with
- Inspection partners, to produce the 410 point report.
Technical data
04 / 04- Collected when
- Whenever you use the site or app: device, IP, session cookies.
- Legal basis
- Legitimate interest: security, fraud detection, reliability.
- Stored in
- AWS me-central-1 (UAE).
- Shared with
- Not shared with any third party.
§ 03 · Why we collect it
22.04.2026
Four reasons, each a direct operational need. Nothing speculative.
- 01
To run the auction
Matching bidders to lots, settling payment, and producing title transfer documents.
- 02
To hold escrow
A CBUAE licensed bank partner holds deposits. Your identity is required to match funds to accounts.
- 03
To meet UAE AML obligations
KYC, sanctions screening, and suspicious activity reporting under Federal Decree Law 20/2018.
- 04
To detect fraud
Device fingerprinting, velocity checks, and rate limits, to protect every participant.
§ 04 · Who we share with
22.04.2026
Named partners, for named purposes. Nothing else, nobody else.
- 01
Our CBUAE licensed bank partner
Escrow and payment settlement.
- 02
Sumsub
KYC and AML verification.
- 03
TAMM and the Abu Dhabi Police
Title transfer and the statutory registration inspection.
- 04
Inspection partners
To produce and deliver the 410 point report on your listing.
- 05
UAE regulators
When legally required by a competent authority.
§ 05 · Where your data lives
22.04.2026
Primarily in the UAE. Transfers abroad only under PDPL safeguards.
Our primary region is AWS me-central-1, located in the UAE. Cross border transfers occur only under the safeguards permitted by Federal Decree Law 45/2021 (PDPL): standard contractual clauses, binding corporate rules, or your explicit consent.
§ 06 · How long we keep it
22.04.2026
By category. The table is short, and deliberately so.
| Data category | While active | After closure |
|---|---|---|
| Account identifiers | Duration of the account | 7 years (UAE AML) |
| Transaction history | Duration of the account | 7 years |
| Inspection reports | Until deletion request | 3 years (consumer law) |
| Session cookies | 30 days, rolling | Deleted immediately |
| Analytics (Plausible) | Aggregated only, no identifiers | Not applicable |
| Waitlist email | Until launch, or your request | Deleted on request |
§ 07 · Your rights
22.04.2026
Access, correct, delete, port, and withdraw. We honour all of them.
- 01
Access
Request a copy of everything we hold about you.
- 02
Correction
Fix inaccurate or outdated data.
- 03
Deletion
Withdraw your data, subject to any regulatory retention windows.
- 04
Portability
Export your data in a machine readable format.
- 05
Withdrawal of consent
Withdraw consent for processing that relies on it, at any time.
§ 08 · Cookies and telemetry
22.04.2026
Session and anti fraud only. Analytics are privacy preserving. No advertising pixels, ever.
- 01
Session
Keeps you signed in and remembers your language. Always on.
- 02
Anti fraud
Velocity and device checks protect every participant. Always on.
- 03
Analytics (Plausible)
Aggregated page views and referrers. No cookies set, no cross site tracking.
- 04
Advertising
None. Ever.
§ 09 · Changes
22.04.2026
We version this document. Material changes are announced fourteen days before they take effect.
When we update this statement, the last updated date changes and a line appears in the revision log below. Material changes, meaning new categories of processing, new recipients, or longer retention windows, are announced to your account email at least fourteen days before they take effect.
§ 10 · Who to write to
22.04.2026
A named inbox for privacy. A response within seven UAE business days.
- 01Data protectiondpo@thabit.ae
- 02Legal requestslegal@thabit.ae
- 03Generalprivacy@thabit.ae
We answer every privacy request within seven UAE business days.
Revision log
What has changed, and when.
| Date | Change |
|---|---|
| 22 April 2026 | Initial publication. |
Privacy statement · April 2026 · Abu Dhabi · Governed by the UAE PDPL and the ADGM Data Protection Regulation