Privacy Policy

Last updated: June 26, 2026

This Privacy Policy explains how Cardex (“Cardex”, “we”, “us”, or “our”) collects, uses, discloses, retains, and protects your personal data when you use our car classifieds platform in the United Arab Emirates. We process personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (the “PDPL”) and its Executive Regulations.

1. Data Controller

The data controller responsible for your personal data is:

• Company: [COMPANY NAME]
• Trade License Number: [TRADE LICENSE NUMBER]
• Data Protection Officer / Contact: [DPO/CONTACT EMAIL]

The data controller determines the purposes and means of processing your personal data and is your primary point of contact for any privacy-related questions or requests.

2. Data We Collect

We collect the following categories of personal data:

• Account information — your name, email address, and mobile phone number provided during registration and used to verify your identity and secure your account.
• Listing data — vehicle details you submit (make, model, year, mileage, specifications, condition), uploaded photographs, asking price, and the emirate where the vehicle is located.
• Messages between users — the content of chat messages you exchange with other buyers or sellers through our in-platform messaging system.
• Device, IP, and usage data — your IP address, device and browser type, pages viewed, searches performed, listings viewed, and similar technical and usage information collected automatically as you interact with the platform.

3. Purposes & Legal Basis

Under the PDPL we may only process personal data where a valid legal basis applies. We rely on the following purposes and bases:

• Operating the marketplace — creating and managing your account, publishing your listings, and enabling buyers and sellers to connect. Legal basis: performance of a contract.
• Communication — delivering messages between users and sending you service-related notifications about your listings and conversations. Legal basis: performance of a contract.
• Fraud prevention & platform safety — detecting, preventing, and investigating fraudulent listings, abuse, and misuse of the platform. Legal basis: legitimate interests.
• Legal compliance — meeting obligations imposed on us by applicable UAE laws and responding to lawful requests from competent authorities. Legal basis: compliance with a legal obligation.
• Analytics — understanding how the platform is used so we can improve features and performance. Legal basis: your consent.

4. Your Data Subject Rights

The PDPL grants you rights over your personal data. You can exercise the following rights directly or by contacting us:

• Right of access — view and export the personal data we hold about you through your account settings.
• Right to data portability — obtain a copy of your data in a structured, machine-readable format via our JSON export endpoint.
• Right to erasure — delete your account and associated personal data from the account deletion option in your settings.
• Right to correction — update or correct inaccurate personal data at any time through the profile update screen.

You also have the right to withdraw consent (where processing is based on consent) and to lodge a complaint with the UAE Data Office.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy. While your account is active, we retain your account and listing data so you can continue to use the platform. When you delete your account, we anonymize or permanently remove your personal data within 30 days, except where we are required to retain certain information to comply with a legal obligation or to resolve disputes.

6. Cross-Border Transfer

Our primary servers are located in [REGION]. To deliver content quickly and reliably to users around the world, we use Cloudflare’s content delivery network (CDN), which may process and cache data at edge locations outside the UAE. Where personal data is transferred outside the UAE, we ensure appropriate safeguards are in place as required by the PDPL, including transfers only to jurisdictions with an adequate level of protection or under approved contractual mechanisms.

7. Cookies

We use two categories of cookies:

• Session cookies (strictly necessary) — required to keep you signed in and to operate core platform features. These are essential to the service and do not require your consent.
• Analytics cookies — help us understand how the platform is used. These are only set after you provide consent through our cookie consent banner, and you may withdraw that consent at any time.

8. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data subject rights, please contact our Data Protection Officer at [DPO/CONTACT EMAIL]. We will respond to your request within 30 days, as required by the PDPL.