A privacy policy is usually a list of categories. This one traces a route instead, because the interesting fact about muscatcarhire.com is where the data goes rather than what it is called. Muscat Car Hire is the controller for the handful of things this website holds, and you can reach us about any of it at [email protected]. Where you are in the European Union or the United Kingdom, the General Data Protection Regulation applies to that handling and this page is written to it.
Hop one: your browser reaches our server
Requesting a page here produces the ordinary technical record any web server produces: the IP address the request came from, the time, the page asked for, the referring page if there was one, and the browser and operating system string your device sends. It also sets a session cookie and a security token, which the cookies page describes item by item. None of this is joined to a name, and we do not use it to build a profile of you. We rely on our legitimate interest in running a site that works and is not being abused, and these records are kept for a short operational period before they age out.
Hop two: your search leaves our server for the supplier network
When you set a pickup point and dates, the search is sent from your browser to our server, and our server passes it to the supplier network that supplies the car listings. What travels is the booking parameters, a location and a date range, plus the technical metadata that accompanies any such call. Your name is not attached, because at this stage we do not have it. The results that come back are then held in your own browser for a few minutes so that paging through them does not refetch everything, which is covered on the cookies page.
Hop three: you choose a car and open the booking window
This is the hop most visitors assume works the other way round. The booking window that opens over a car is the supplier network's own component, loaded into this page from their domain. The details you type into it, the main driver's name, contact details, flight or delivery information and anything else they ask for, are collected by them inside their component and sent to them. They are not posted to muscatcarhire.com and they do not land in our database. From that point they are handling your data as a controller in their own right, under their own policy, and you can ask them for it directly.
One consequence is worth stating plainly: we never see and never ask for your payment card number, your passport number or your driving licence number. If something presenting itself as this website asks you for those by email, it is not us.
Hop four: the request reaches a rental company in Oman, and crosses a border
Oman sits outside the European Economic Area, so this is a genuine international transfer rather than a paragraph added for form's sake. For a booking in Muscat to exist at all, your details have to reach a company operating here, which means personal data leaving the protection of the European framework and arriving somewhere the European Commission has not issued an adequacy decision for.
Where that transfer is made by us or on our behalf, the mechanism we rely on is the European Commission's standard contractual clauses, the model terms designed for exactly this situation, supported by a check that the receiving party can actually honour them in practice. Where the supplier takes your details directly through their own booking component, the transfer is theirs to account for and their policy is the one that covers it. We would rather tell you the border is being crossed than let it look like a technicality.
Hop five: a confirmation comes back
The confirmation and the voucher are issued by the supplier to you. We are told that a booking attributable to this site was completed, because that is how the commission is accounted for, and that record is commercial rather than personal in character. We do not receive a copy of your rental agreement.
The one form on this site that does post to us
The reviews page carries a form for leaving a comment about a rental. It asks for a display name, a rating, the comment itself, and an email address which is optional and is used only to reply to you or to check a submission is genuine. That is the one place where you hand something to Muscat Car Hire directly, and the basis for holding it is your consent, given by sending it. Ask us to remove it and we will. If you also write to us at the address above, we keep the correspondence for as long as the matter is open and for a reasonable period afterwards in case it reopens.
Oman has personal data protection law of its own
European rules are not the only ones in play here. Oman has enacted its own personal data protection legislation, overseen by the responsible national authority, which governs how organisations established here collect and use personal data and provides for consent, for purpose limitation and for individual rights of access and correction. A supplier you book with in Muscat is answerable under that law for what they do with your details, alongside whatever they owe you under European rules for the transfer itself.
We describe it in general terms on purpose. The detail of how it applies to a particular supplier, and the procedure for exercising a right under it, is a matter for that supplier and for the authority that supervises them, and we are not going to paraphrase their obligations into something that reads more precise than it is.
Your rights, and the practical limit on them
Within the GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to erase it, ask us to restrict or object to how it is used, and ask for it in a portable form where that applies. Where we rely on consent you can withdraw it at any time, which does not undo what was lawful before. Send any of these to [email protected] and we will answer within the statutory period.
The limit is the one the route above implies. We can only act on what we actually hold, and for a booking that is very little. A request about your rental, your voucher, the deposit or the details on your agreement has to go to the supplier, because they are the controller for it. We will tell you who they were if that is the part you are missing. You also have the right to complain to the data protection authority in the country you live in.
Security, children, and changes to this page
The site is served over HTTPS and what little we hold is kept on access controlled systems with the number of people who can reach it kept small. No arrangement on the internet is perfect and we will not claim otherwise. The site is aimed at adults who are old enough to rent a car and we do not knowingly collect anything from children; if you believe a child has sent us something, write and we will delete it.
We update this page when the way the site works or the law makes it necessary, and the version published when you visit is the one that applies. Muscat Car Hire works by email and operates no telephone line, by design, so that a question about your data and our answer to it both exist in writing. Write to [email protected].