Last updated: 22 October 2026
1. Who this is between
This agreement is between your company, the rent a car company that uses DECK, and RETA LLC, a company based in the United Arab Emirates, which provides DECK. It is part of the terms of service and applies for as long as your company has a DECK account. It is written for the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021. Where it says more about personal data than the terms do, this agreement applies.
2. Who decides and who processes
Your company decides which personal data goes into DECK and why, so your company is the controller. RETA processes that data for you, only to run DECK and only on your instructions. Your instructions are the settings you choose, what your team does in the panel and this agreement. If we believe an instruction breaks the law, we tell you and do not carry it out.
Some data we handle for our own purposes, such as your account, your subscription and our invoices to you. That is covered by the privacy policy, not by this agreement.
3. Whose data, and what
- Your renters and additional drivers: names, nationality, date of birth, gender, address, phone and email, identity and driving licence documents with their numbers and images, signatures, rental details, the fines and tolls on their rentals and, if you take card payments, the card's brand, last four digits and expiry and the record of their consent.
- Your team: names, emails, phone numbers, roles, what each person did in the panel and when, the time, IP address and browser of each signed-in session, and recordings of the panel's screen.
- Your vehicles and accounts: plates and vehicle details, and what DECK reads from the government accounts you connect, as section 5 describes.
4. What we do with it
Only what DECK is for: store it, show it to your team, prepare, sign, print and send your agreements, read the documents you scan, put tolls and fines on the right rental, send the emails and WhatsApp messages your team asks for, take card payments through your own Stripe account, send rentals to TARS as your team asks, and keep DECK secure and working. We do not sell your data, we do not mine it and we do not use it to train anything.
5. Your government accounts
If you connect Salik, Darb or TARS, you authorise RETA to access those accounts on your company's behalf, including by automated means, with the sign-in details or the session you give DECK:
- Salik and Darb: only to read your tolls, your balance and the vehicles on the account. DECK never tops up, pays or changes anything there.
- TARS: to submit, close and cancel your rentals as your team asks, to download the TARS copy of a contract, and to bring your cars, customers, contracts, fines and Salik tolls into DECK.
RTA fines are looked up by the plates of the cars in your fleet and need no account. You confirm that the accounts you connect are your company's, that you may give us this access, and that the details you give are correct. You can remove your TARS details in Settings at any time, and ask us to disconnect Salik or Darb by writing to us; DECK then stops using that account. What is submitted to TARS in your company's name is your company's responsibility.
6. People
Only DECK's own engineers can reach the production systems, only to support you, to find and fix a problem or to keep the service running, and each of them is bound to keep your data confidential.
7. Security
Document numbers, document copies, signed agreements, accounting documents, bank statement descriptions, payment provider keys and your government sign-in details are encrypted by DECK before they are stored. Every company's data is kept apart at the database level, connections are encrypted, and backups are encrypted and locked against deletion for 30 days. The security page describes the rest.
8. Sub-processors
You agree that we use these companies to run DECK:
- Amazon Web Services: servers, database, file storage and outgoing email. Servers and database in Frankfurt, Germany; files in the United Arab Emirates with a standby copy in Frankfurt; backups in Frankfurt and Ireland.
- Cloudflare: passes every request between the panel and our servers to block attacks, and checks that a sign-up comes from a person. Its data centres are spread around the world, and it does not keep the traffic.
- Vercel: serves the panel's pages and the deck.ae website. The data you enter in the panel goes to our servers, not to Vercel, except error reports and screen recordings, which pass through it on their way to Sentry.
- Sentry: receives the panel's and our servers' error reports and the recordings of the panel's screen, in Frankfurt, Germany.
- OpenRouter, in the United States, and the company that runs the AI model it passes the request to: read identity documents, receipts, invoices and bank statements, outside the UAE, under an instruction that the request may only be handled by a company that does not collect it or use it to train.
- Meta: carries the WhatsApp messages and files sent to and from DECK's WhatsApp number, under its own terms for WhatsApp.
- Google: only for team members who choose to sign in with Google.
- A network provider: carries DECK's connections to the Salik, Darb, RTA and TARS portals so that they come from the UAE. The connections are encrypted end to end.
Stripe is not on this list: it works for you under your own agreement with it. We choose sub-processors whose terms stop them using your data for their own purposes. Before we add or replace one, we update this page and email the owner of your account at least 30 days ahead. If you object and we cannot meet the objection, you can close your account before the change applies.
9. Data outside the UAE
Your data is stored in the UAE and in the European Union: Germany and Ireland, where the GDPR applies, and our agreement with Amazon includes data protection terms. For the length of a single task, a document goes to the reading service outside the UAE and a TARS submission goes to the RTA. You agree to these transfers so that DECK can work. We plan to bring the servers and database to the UAE when Amazon's UAE region can run them, and we will update this page when that happens.
10. Helping you answer people
Most of what a renter or a team member can ask for, seeing, correcting or deleting their data, your team can do in the panel. If you need more, write to info@deck.ae and we will help. If a person writes to us about data your company holds, we pass the request to you and help you answer it. We also help, where we reasonably can, when a regulator asks you about the data DECK holds for you.
11. If something goes wrong
If we learn of a breach that affects your company's personal data, we tell the owner of your account without delay, and in any case within 48 hours. We say what happened, which data and people may be affected, what we have done and what you may need to do, and we keep you updated as we learn more.
12. When your account closes
Before you go, download what you want to keep: signed agreements, invoices and receipts one by one, and the accounting for any month, quarter or year as a pack. When you close your account, we delete your company's data within 30 days, and encrypted backups expire on their own within 70 days after that. Error reports, screen recordings and server logs run out on the schedule in the privacy policy. We keep records tied to invoicing and tax for as long as UAE tax law requires, for that reason and nothing else.
13. Showing that we keep to this
If you ask, we answer reasonable written questions about how DECK protects your data, and this page, the privacy policy and the security page stay up to date.
14. Changes
If we change this agreement in a way that matters, we say so on this page, change the date at the top and email the owner of your account before the change applies.