Skip to Content

Privacy Policy

Last updated: 3 October 2026

This Privacy Policy explains how E X Holidays Travel and Tourism L.L.C., trading as X Holidays, collects, uses, shares and protects your personal data. It applies when you visit www.xholidays.com, contact us, or book travel services with us. In this policy, “we”, “us” and “our” mean E X Holidays Travel and Tourism L.L.C.

We handle personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, which we call “the PDPL” in this policy. We also follow the other UAE laws that apply, including Federal Law No. 15 of 2020 on Consumer Protection and its executive regulations, and the UAE e-commerce law, Federal Decree-Law No. 14 of 2023. Please read this policy together with our Terms and Conditions.

1. Who we are

E X Holidays Travel and Tourism L.L.C. is a travel agency based in Dubai, United Arab Emirates. We are the controller of the personal data described in this policy. This means we decide how and why your personal data is used.

When you book a flight, hotel, car, cruise, tour or other travel service through us, we act as a booking agent for the supplier that provides it. That supplier, for example an airline or hotel, also uses your personal data under its own privacy policy. We recommend that you read it.

2. Personal data we collect

Information you give us

  • Identity and contact details: your full name as shown on your passport, title, date of birth, nationality, email address, phone and WhatsApp number, and billing address.
  • Travel and identity documents: passport details and copies, national identity cards, visa and residence documents, and photographs when a visa application needs them.
  • Booking details: travel dates and destinations, the flights, hotels and other services you ask for, details of the people travelling with you, frequent flyer or loyalty numbers, and your travel preferences and special requests, such as seat or room preferences.
  • Payment and billing details: quotations, invoices, the amounts you pay, payment references, bank transfer details such as the name of the paying account, and the bank account details you give us when we send you a refund.
  • Communications: emails, WhatsApp messages, messages sent through our website contact form, and notes of phone calls with our team, along with any documents you send us.

Sensitive information

The PDPL treats some information as sensitive. We collect it only when you, or the person booking for you, give it to us because a service you asked for needs it. For example:

  • health, mobility, dietary or accessibility information, such as a request for wheelchair assistance, a special meal or an accessible room, or details needed to arrange travel insurance;
  • information that may show your religious beliefs, such as booking an Umrah package or asking for a religious meal option.

We use this information only to arrange and provide the services you asked for. We share it only with the suppliers, insurers or authorities that need it for that purpose, and with the service providers that carry, store or process our messages and records for us, such as our WhatsApp, email and hosting providers and the technology providers that power our WhatsApp concierge (see section 5).

We will ask for your clear consent when we collect sensitive information, unless the law allows us to use it without consent, for example in an emergency to protect your interests. If you give us sensitive information about another traveller, please make sure they have agreed to this first.

Card payments

When you pay by card, you enter your card details directly on the secure payment pages of our payment providers, Network International and Stripe. We do not see or store your full card number or your card security code. We receive confirmation of the payment and the limited details we need to record it and match it to your booking, such as the amount, date, status and transaction reference.

Information collected when you use our website

When you visit www.xholidays.com, we and the provider that delivers our website automatically receive technical information. This includes your IP address, browser and device type, the pages you open, and the date and time of your visit. We use it to show you the website, keep it secure and fix problems. Section 9 explains how we use cookies.

Information from other sources

We may receive personal data about you from:

  • the person who makes a booking that includes you, such as a family member, colleague or employer;
  • travel suppliers, such as airlines and hotels, for example booking references, e-tickets and schedule changes;
  • visa authorities, about the progress or outcome of a visa application;
  • our payment providers and banks, about the status of your payment or refund.

If you book for other travellers or send us their details, please make sure they agree to this and know about this policy.

3. How we use your data and why

We use personal data only for clear purposes, and only when the law allows it. The reasons are explained below.

To provide the services you ask for

We use most of the personal data we hold to carry out our agreement with you, or to take steps you ask for before you book. This includes:

  • answering your enquiries and preparing quotations and itineraries;
  • making, changing and cancelling bookings with airlines, hotels and other suppliers;
  • preparing and submitting visa applications that you ask us to help with;
  • arranging travel insurance;
  • taking payments, issuing invoices and receipts, and handling refunds and credits;
  • sending booking confirmations, travel documents and important updates, such as schedule changes;
  • supporting you before and during your trip.

To meet our legal obligations

We use personal data to comply with the laws that apply to us, including:

  • keeping accounting, tax and VAT records;
  • meeting passenger information and travel document rules set by airlines, immigration and border authorities;
  • responding to lawful requests from courts, police, regulators and other authorities.

To run and protect our business

We also use personal data where the PDPL allows us to do so without asking for separate consent, for example because it is needed to perform our agreement with you, to meet a legal obligation, or to establish, exercise or defend a legal claim. We do this only in ways that respect your rights, to:

  • keep records of our communications with you and resolve questions and complaints;
  • prevent, detect and investigate fraud, payment misuse and security threats;
  • establish, exercise or defend legal claims.

To improve our services, website, customer support and WhatsApp concierge, we use information that has been anonymised so that it no longer identifies you. If we want to use information that identifies you for this purpose, we will ask for your consent first.

To protect you in an emergency

If something serious happens while you are travelling, we may use and share your information as needed to protect your safety and interests.

With your consent

We ask for your agreement before we use your personal data for:

  • sending you marketing messages about offers, packages and travel ideas (see section 10);
  • using sensitive information, such as health information, where the law requires your consent (see section 2);
  • using information that identifies you to improve our services or our WhatsApp concierge;
  • any other purpose that we explain to you and ask you to agree to at the time.

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

4. Our WhatsApp concierge

Our AI-powered WhatsApp concierge helps you plan trips and request bookings by chat. When you message us on WhatsApp at +971 600 5 00003 or +971 600 577778:

  • we receive your messages, your WhatsApp profile name, your phone number and any files you send, through the Meta WhatsApp Business Platform;
  • automated technology, including artificial intelligence, reads your messages so it can understand your request, answer your questions and help you plan and request bookings;
  • we keep a record of the conversation so our team can follow up, support you and resolve any questions later.

Please do not send card numbers, card security codes or passwords by WhatsApp or email. We will never ask for them in a chat. Card payments are made only through our secure payment links.

Because larger amounts may be paid through several payment links, you may receive more than one link for the same booking. If you receive a payment link or a request for payment that you are not sure came from us, contact us on +971 600 5 00003 or at [email protected] before you pay.

If you prefer not to use the concierge, you can contact our team by email or phone instead. You also have the right to object to any decision about you that is made only by automated means and that has legal effects on you or seriously affects you, and to ask a member of our team to review it.

5. Who we share your data with

We share personal data only when it is needed for the purposes in this policy, and we share only what is needed. We do not sell your personal data.

  • Travel suppliers: airlines, hotels, transport and car rental companies, cruise lines, insurers and local tour operators that provide the services you book. They use your data to provide those services and are responsible for it under their own privacy policies.
  • Visa authorities and governments: embassies, consulates, immigration and border authorities and their authorised visa application centres, when you ask us to help with a visa or when travel rules require passenger information.
  • Payment providers and banks: Network International and Stripe, which process card payments and help prevent fraud, and the banks that handle transfers and refunds.
  • Meta: the provider of the WhatsApp Business Platform we use to send and receive WhatsApp messages. Meta also processes WhatsApp data under its own terms and privacy policy.
  • Service providers that support our business: our email providers, the providers that host our business systems and website, and other IT and technology providers, including those that power our WhatsApp concierge. We allow them to use your data only to provide their services to us.
  • Professional advisers: such as accountants, auditors, lawyers and insurers, when needed.
  • Authorities, when the law requires it: courts, police, tax authorities, regulators and other public bodies, or when needed to protect our rights, our customers or other people.

6. International transfers

Travel is international, so your data often has to be sent outside the UAE. For example, we must share your booking details with an airline or a hotel in the country you are visiting, or with the embassy of a country you are applying to visit.

Our business systems, which hold booking, invoicing and email records, are hosted on servers in the European Union. Some of our other service providers, including our payment providers, Meta, the technology providers that power our WhatsApp concierge, and our website and email providers, may also process data in other countries.

We send personal data outside the UAE only in the ways the PDPL allows, for example:

  • to countries whose data protection laws give an adequate level of protection;
  • when the transfer is needed to carry out your booking or another agreement with you, or to take steps you have asked for;
  • under written agreements that require the recipient to protect your data; or
  • with your consent.

7. How we keep your data safe

We use technical and organisational measures that suit the risk, including:

  • encrypted connections, known as HTTPS, for our website and payment links;
  • access controls, so only staff and providers who need personal data for their work can see it;
  • password protection on our business systems;
  • using established payment providers for card payments, so we never handle full card numbers.

No way of sending or storing data is completely secure, but we work to protect your data and review our measures regularly. If a data breach affects your personal data, we will act to limit the harm, and we will tell you and the UAE Data Office where the law requires it.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes in this policy, or as long as the law requires.

  • Booking, invoicing and accounting records: kept for as long as UAE law requires. Accounting and tax records, including invoices and VAT records, are kept for at least seven years after the end of the tax period they relate to, in line with UAE tax laws.
  • Passport, visa and other travel documents: kept only as long as needed for your booking or visa application, any follow-up, and any records the law requires us to keep.
  • Enquiries and quotations that do not lead to a booking: kept only as long as needed to respond to you and follow up on your request.
  • Marketing preferences: we keep a record of your choice, including a request to stop, so that we can respect it.

We may keep data longer if we need it to handle a complaint or a legal claim. When we no longer need personal data, we delete it or anonymise it securely.

9. Cookies

Cookies are small files that a website saves on your device. At present our website uses only essential cookies that it needs to work, such as cookies that:

  • keep your session working as you move between pages, fill in forms or use payment links;
  • remember your language preference;
  • identify your visit or session so the website works properly and stays secure.

We do not currently use analytics or advertising cookies or trackers. You can block or delete cookies in your browser settings, but some parts of the website may not work properly without essential cookies.

When you pay by card, the secure payment page of Network International or Stripe may use its own cookies, for example to prevent fraud. Those cookies are controlled by the payment provider under its own policy, not by us.

If we decide to use analytics or advertising cookies in the future, we will update this policy first and ask for your consent before using them.

10. Marketing messages

We send marketing messages, such as special offers and holiday ideas, by email or WhatsApp only if you have agreed to receive them. You can change your mind at any time by:

  • using the unsubscribe link in any marketing email;
  • replying to a marketing WhatsApp message and asking us to stop; or
  • emailing us at [email protected].

If you opt out of marketing, we will still send you messages about your bookings and payments, such as confirmations, changes and travel documents.

11. Children

Bookings must be made by an adult. When children travel, a parent or legal guardian, or another adult with their permission, makes the booking and gives us the child’s details we need, such as passport and visa information. We do not knowingly collect personal data directly from children. If you think a child has sent us personal data without a parent or guardian knowing, please contact us and we will delete it unless we need to keep it for a booking or by law.

12. Your rights

Under the PDPL you have the right to:

  • Access: ask what personal data we hold about you, how we use it, who we share it with and where it came from, and get a copy of it;
  • Correction: ask us to correct data that is wrong or complete data that is incomplete;
  • Erasure: ask us to delete your personal data, for example when we no longer need it, when you withdraw your consent, or when it has been used unlawfully;
  • Restriction: ask us to limit how we use your data, for example while we check whether it is accurate or while a disagreement is resolved;
  • Objection: object to our use of your data, including for direct marketing, and to decisions made only by automated means that have legal effects on you or seriously affect you;
  • Portability: ask for your data in a structured, commonly used, machine-readable format, or ask us to send it to another organisation where this is technically possible;
  • Withdrawing consent: withdraw any consent you have given us, at any time.

How to use your rights

Email us at [email protected] or write to us at our office. To protect your data, we may ask you to confirm your identity before we act on a request. We will respond within the time the law requires, and we do not charge for responding to these requests.

Sometimes we may not be able to meet a request in full, for example when the law requires us to keep certain records or when we need the data for a legal claim. If so, we will explain why. Please note that if you ask us to delete or stop using details we need for a booking, such as passport information, we may not be able to complete that booking.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put things right. You also have the right to complain to the UAE Data Office, the federal authority responsible for personal data protection in the UAE.

14. Changes to this policy

We may update this policy from time to time, for example when our services or the law change. The current version is always available at www.xholidays.com/privacy, with the date of the last update at the top. If we make important changes, we will also tell you by email, WhatsApp or a notice on our website where appropriate.

15. Contact us

If you have questions about this policy or your personal data, please contact us:

  • Email: [email protected]
  • Phone and WhatsApp: +971 600 5 00003
  • Office: E X Holidays Travel and Tourism L.L.C., Office No. 219, Al Qusais Industrial First, Deira, Dubai, United Arab Emirates