Privacy Policy
Version 0.1. Last updated 29 July 2026. Effective from 16 October 2026.
1. Who is responsible for your data
FOAMMEUP SHINE PARKING CAR WASH L.L.C S.O.C is the controller of the personal data described on this page. In this policy we call it "FoamMeUp", "we" or "us".
Email: hello@foammeup.ae
Phone and WhatsApp: 058 552 7588
Post: [DECISION 14: registered address to be inserted from the trade licence]
This policy is written against Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL), which came into force on 2 January 2022.
An honest note on the state of the law. The PDPL requires its Executive Regulations to be issued, and gives controllers a further six months after they appear to bring themselves into line (Articles 28 and 29). Those Executive Regulations have still not been issued. As of a practitioner review published on 10 March 2026, they had not appeared, enforcement activity had been limited, and the UAE Data Office was not yet fully operational. We are not waiting for them. This policy is written to the law as it stands, and we will update it when the regulations arrive.
2. What we collect
When you sign up and book
- Your name, email address and mobile number.
- Your villa address and community.
- The plan you choose and the add-ons you buy.
- The time band you prefer.
- Access details you give us, for example a gate code or an instruction about where the tap is.
About your vehicle
- Make, model, colour and registration plate.
- Whether it has paint protection film, a wrap or a ceramic coating.
- Notes about existing damage.
Photographs, taken by our operator on every visit:
- Before photographs of the vehicle at the start of the wash.
- After photographs at the end.
- Damage photographs, where the operator finds existing damage on arrival.
- An unreachable photograph where a visit cannot go ahead, showing the empty driveway, the locked gate, or the blocking vehicle.
These photographs are of your vehicle on your driveway. They will normally show your registration plate, and they may incidentally show part of your property, your other vehicles, or a person who walks into frame. We treat all of that as personal data.
When you message us
- The content of your WhatsApp conversations with us, and the phone number they come from.
- Emails you send us, and our replies.
When you pay
- The fact, amount, date and status of each payment.
- The last four digits and card type, as reported back to us.
- We never see or hold your full card number. Your card details go directly to Stripe.
When you use the website
- Standard technical data from your browser and any cookies we run. [DECISION 15: cookie banner and cookie list to be completed once the website build is final. This section cannot be published as a blank.]
3. Why we use it, and on what legal basis
Article 4 of the PDPL permits processing without consent in defined cases, including where processing is necessary for the performance of a contract to which the data subject is a party. Article 6 governs consent where we rely on it.
| What we do | Why | Basis |
|---|---|---|
| Set up and run your subscription, route the operator, send you the evening confirmation | We cannot deliver the service you bought without it | Performance of your contract, PDPL Article 4 |
| Take and keep before, after and damage photographs | To record the condition of your vehicle at each visit, so that a later dispute about damage can be settled on evidence rather than memory | Performance of your contract, PDPL Article 4. See section 4 |
| Take payment through Stripe, issue invoices | To charge you and to meet our tax and accounting obligations | Performance of your contract and legal obligation, PDPL Article 4 |
| Answer your messages and handle complaints | To respond to you and to meet our obligations under consumer law | Performance of your contract and legal obligation, PDPL Article 4 |
| Send you marketing about new services or offers | Only if you have said yes | Your consent, PDPL Article 6. You can withdraw it at any time |
| Use your vehicle photographs in marketing | Only if you have separately said yes to that specific use | Your separate consent, PDPL Article 6 |
Article 4 of Federal Law No. 15 of 2020 on Consumer Protection gives you the right to have the privacy and security of your data protected, and for it not to be used for promotional and marketing purposes. We treat marketing as opt in for that reason, and we keep it separate from the operational messages we have to send you to deliver the wash.
We do not sell your personal data. We do not use it to make automated decisions that produce a legal effect on you.
4. The photographs, in detail
This is the part of the service with the most privacy weight, so it gets its own section.
Who takes them. The operator who washes your vehicle, on a company phone, in the FoamMeUp operator application built on Zoho Creator.
Where they go. From the operator's phone into Zoho Creator, then into a company archive on Zoho WorkDrive, with a second copy held with Backblaze B2 so that one supplier failure does not destroy the record.
Who can see them. The operator who took them, and the owner of the business. Not other customers. Not the public. Our customer portal shows you the photographs from your own recent washes.
How long we keep them. 12 months from the date of the wash, in both stores, deleted together by a scheduled job. If there is an open damage complaint relating to that wash, we hold those photographs until the complaint is resolved and for a further 90 days after that in case it reopens.
Why 12 months and not less. A customer who notices a mark months later can still be checked against that visit's own timestamped record. Every operational window we run is far shorter than 12 months.
Why we do not just delete them after each wash. Because they protect you as much as us. If a mark was on the vehicle before we arrived, the arrival photograph shows it. If we caused it, the before and after pair shows that too.
Marketing. We will not put a photograph of your vehicle on our website, our social media, or a leaflet unless you have specifically agreed to that use. Agreeing to the wash is not agreeing to that.
[LEGAL REVIEW: whether "performance of the contract" under PDPL Article 4 is the right basis for damage-evidence photographs, or whether express consent should be taken at sign-up as well. Also whether a 12 month retention is defensible against the UAE limitation period for a property damage claim, which we could not confirm.]
5. Who we share it with
We use these suppliers. Each of them processes personal data on our behalf, or in Stripe's case as a payment processor in its own right.
| Supplier | What they handle |
|---|---|
| Zoho (CRM, Creator, WorkDrive, SalesIQ, Books, Mail) | Your customer record, bookings, the operator app, the photograph archive, WhatsApp conversations routed into our inbox, invoices, our email |
| Stripe | Your card payment. Stripe holds the card details, we do not |
| Meta Platforms (WhatsApp Business Platform) | The delivery of WhatsApp messages between you and us |
| Backblaze (B2 storage) | The second copy of the photograph archive |
We also share personal data where the law requires it, for example with a court, the police, the Dubai Department of Economy and Tourism, or the Federal Tax Authority.
Our operators see your name, address, vehicle and access instructions on their runsheet. Nothing more.
6. Where your data is held
We are going to be straight with you about this, because it is easy to overstate.
Our Zoho organisation was almost certainly provisioned in a United States data centre. Zoho's own published data centre list, updated 18 November 2025, names the United States, Europe, India, Australia, Japan, Canada and Saudi Arabia, and does not name the UAE, although Zoho separately announced Abu Dhabi and Dubai data centres in January 2026. Those two Zoho statements do not agree with each other, and we have not been able to resolve which applies to our account.
So: we do not claim your data is held in the UAE. Stripe, Meta and Backblaze also process data outside the UAE.
Articles 22 and 23 of the PDPL govern transfers of personal data outside the UAE, permitting them where the destination has adequate protection, where there is an agreement in place, or with the data subject's express consent among other cases. The PDPL does not require personal data to be stored inside the UAE.
[LEGAL REVIEW: which limb of PDPL Articles 22 and 23 we rely on for each supplier, and whether express consent needs to be taken at sign-up. This cannot be settled properly until the Executive Regulations exist, and the honest position is that most UAE businesses are in the same position.]
7. How long we keep things
| Data | Kept for |
|---|---|
| Wash photographs | 12 months from the wash, plus a hold while a damage complaint is open and 90 days after it closes |
| Your customer record, bookings and wash history | For as long as you are a customer, and afterwards for as long as we need it for tax, accounting and any live dispute |
| Invoices and payment records | As required by UAE tax and accounting law [DECISION 16: confirm the retention period required, commonly stated as five years, with the accountant] |
| WhatsApp and email conversations | [DECISION 17: set a period. Our recommendation is 24 months] |
| Marketing consent records | For as long as you are subscribed, and afterwards as proof that you consented and when you withdrew |
8. Your rights
Under the PDPL you have the right to:
- Be told what personal data we hold, why we process it, who we share it with, how long we keep it, and how to complain. That is what this page is for. Article 13.
- Get a copy of your personal data in a structured, machine readable form, and to have it moved to another controller where that is technically possible. Article 14.
- Have inaccurate data corrected, and have data erased. Article 15.
- Restrict our processing of your data in defined cases. Article 16.
- Stop us processing your data, including for direct marketing. Article 17.
- Object to automated processing that produces legal consequences for you. Article 18.
How to use them. Email hello@foammeup.ae or message 058 552 7588 and say what you want. We will confirm we have received it and tell you what we are doing.
[DECISION 18: the response time we commit to. The PDPL leaves the period to the Executive Regulations, which do not exist. Our recommendation is to publish 30 days and beat it.]
Withdrawing marketing consent takes effect immediately and does not stop us sending you the operational messages we need to send to deliver a wash you have paid for, such as the evening before confirmation.
9. If your data is breached
If personal data we hold is breached in a way that would prejudice your privacy, confidentiality or security, Article 9 of the PDPL requires us to notify the UAE Data Office immediately, and to notify affected individuals. The notification periods for individuals are left to the Executive Regulations, which have not been issued.
Our commitment, regardless: we will tell you, in plain words, what happened, what data was involved, and what you should do. We will not sit on it.
10. Children
The service is for adults. We do not knowingly collect personal data about children. If a child walks into frame in a wash photograph, that photograph is subject to the same retention rule and the same access limits as every other photograph, and you can ask us to delete it.
11. Cookies
[DECISION 15: to be completed with the website build. This section must list each cookie, what it does, and how to refuse it, before the page is published.]
12. Complaints
Complain to us first. hello@foammeup.ae. Tell us what you think we got wrong.
If we do not fix it, you can complain to the UAE Data Office, the federal authority established under the PDPL. [LEGAL REVIEW: the Data Office was reported in March 2026 as not yet fully operational, with the TDRA providing administrative support during a transitional period. Confirm the correct complaint route and address before publishing.]
You can also raise a consumer complaint about how we handled your data with the Dubai Department of Economy and Tourism through consumerrights.gov.ae, or with the Ministry of Economy on 800 1222.
13. Data protection officer
We have not appointed a data protection officer. Article 10 of the PDPL requires one where processing would cause a high level of risk, involves systematic and comprehensive assessment of sensitive personal data, or involves large scale processing of sensitive personal data.
[LEGAL REVIEW: confirm that photographing customer vehicles and premises at a launch scale of roughly 16 washes a day does not cross the Article 10 threshold. Our reading is that it does not, because the data is not sensitive personal data as the PDPL defines it and the scale is small. That reading needs checking.]
14. Changes to this policy
We will publish any new version here with a version number and a date. Where a change materially affects how we use your data, we will tell you by email before it takes effect.
FOAMMEUP SHINE PARKING CAR WASH L.L.C S.O.C
Dubai, United Arab Emirates. Trade licence 1639213.
hello@foammeup.ae · 058 552 7588 · foammeup.ae