This policy explains what happens to your data when you use rent.beartpro.com, the BeART Rentals Telegram bot, your account area, or the partner portal. It is written from what our system actually does, not from a template. If you find anything here that does not match reality, tell us: that is a mistake, and we will fix either the text or the system.
This policy forms an integral part of the Equipment Rental Terms and Conditions.
THE SHORT VERSION
- Your conversation with our assistant is processed by a language model operated by Anthropic (USA). Our staff may also read it, so that we can step in when the bot answers incorrectly.
- The photo of your passport or Emirates ID that you upload for identity verification goes to our company's Telegram chat, where our staff member checks it. It goes to Anthropic (USA) to read the fields only if you tick a separate box for that.
- We are required to keep order, invoice and payment records for 7 years under UAE tax law. We will not delete those even if you ask us to.
- If you leave your passport with us instead of a cash deposit, we keep the physical passport in a safe and record only the last 4 characters of its number (section 5.6).
- We do not sell your data. Google Analytics and Google Ads run on the site only if you click "Accept" in the cookie notice. Without that, the site sets only the technical cookies listed in section 14.
- Any question about your data: [email protected]
1. WHO PROCESSES YOUR DATA
The controller of your personal data is:
Raised by Future Records FZE
Trading as: BeART Production, BeART Rentals
Licence No. 5973/2014, Fujairah Creative City
Address: Office 1309, Creative Tower, Fujairah, United Arab Emirates
Tax Registration Number (VAT TRN): 100293867600003
Corporate Tax Registration Number (CT TRN): 100293867600001
Email: [email protected]
Telegram: @rent_beartpro_bot
Website: https://rent.beartpro.com
We apply the law of the United Arab Emirates to the processing of your data, primarily Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").
Questions, requests and complaints about personal data: [email protected]. This is a dedicated data protection channel and you may use it directly.
2. WHO THIS POLICY COVERS
- Clients — individuals and companies renting equipment from us through any channel: the website, the Telegram bot, the account area, or directly through a manager.
- Site visitors — people who have not signed in, including those talking to the assistant anonymously.
- Partners — equipment owners working with us through the partner portal.
- Gaffers — professionals who place orders for their own clients through the gaffer account.
- Referrers and referral partners — people and businesses who invite others through a referral link or code.
- Clients whose details someone else gave us — if a gaffer or our staff member enters your details to prepare an order for you, we receive your name, email, phone and company details from them, not from you. We then send you an email with the quote and a link to sign in. If you did not ask for this, tell us and we will delete your details.
- Staff — people with access to the administrative part of the system.
3. WHAT DATA WE COLLECT
3.1. What you tell us yourself
- Contact details and profile: first and last name, phone number, email address, language.
- Company details, if you rent as a legal entity: company name, tax registration number (TRN), registered address, trade licence number and its expiry date.
- Delivery and return address: the address text, delivery notes and, if you send it, a map pin.
- Identity documents: passport or Emirates ID (see section 5 in detail). For companies — trade licence and constitutional documents.
- Conversations: everything you write to our assistant in the Telegram bot and in the website chat, along with reference photos and voice messages you send.
- Support requests and post-rental feedback.
- Your own equipment: if you tell the assistant what you already own, we save it so as not to offer you things you do not need.
- Passport left as a deposit: if you choose this option, see section 5.6.
- Payout details, if you receive payouts from us as a gaffer or referral partner: the payee's name, bank account number (IBAN) and the last 4 characters of the identity document number.
- Companies under a framework agreement: the names, positions and identity document numbers of the people the company authorises to order, collect and return equipment, and the name, position and masked document number of the person who signs for the company and of any guarantor. We do not keep copies of their identity documents.
3.2. What we receive automatically
- From Telegram, if you write to the bot or sign in through Telegram: your numeric user ID, your @username and your profile name.
- From Google or Apple, if you sign in through them: your email address and the internal identifier of your account with that provider.
- Technical sign-in data: a fingerprint of your IP address (not the address itself — see section 13), your browser and device string, sign-in method, sign-in time, and a new-device flag. Failed and blocked sign-in attempts are recorded too, without the code you entered.
- Passkeys, if you set one up: the public key, its identifier, a usage counter, the device name and the dates it was created and last used. The private key never leaves your device.
- Referral links: if you open a link with a referral code, we record the code, the time, the page and fingerprints (hashes) of your IP address and browser string. We use them to count one click per day and to prevent abuse.
- From our bank, if you pay by bank transfer: the payer's name, the amount, the bank reference and the value date.
3.3. What our system generates
- Order history: kit contents, rental dates, amounts, discounts, payment status, deposit, and a log of deposit holds and releases (what was held, when, who released it).
- Deposit terms set for you: the percentage or fixed amount of your deposit, a waiver if one applies, and an internal note. Only the company owner sets these (section 6.6).
- Referral records: who invited whom, credits and rewards.
- Data read from your documents by artificial intelligence: name, document number, expiry date, date of birth, nationality, plus technical notes on image quality and authenticity.
- Photo and video records of equipment condition at handover and at return.
- Service records: sign-in log, staff action log, records of your acceptance of the Terms and of the consents you have given.
3.4. Free-text fields
In several places in the system, our staff and you write free text: shoot brief, order comments, description of an item left as security, notes about a client, support request text. We try not to write anything unnecessary there, but we cannot guarantee that no additional information about you ends up in those fields. If you want to know what is recorded about you in free-text fields, request an export (section 10).
3.5. What we never collect
Your bank card details (you enter them only on Stripe's secure page; we never see them), passwords to other services, information about your health, religion, political views or origin (other than the nationality stated in your document), and biometric templates — we run no facial recognition and do not match your face against any database.
4. WHY WE PROCESS DATA AND ON WHAT LEGAL BASIS
UAE law is stricter than European law here: processing personal data without the person's consent is prohibited as a general rule, and the law sets out a closed list of exceptions (Article 4 PDPL). There is no "legitimate interest of the company" in that list. So wherever we cannot rely on performing our contract with you, on a legal obligation, or on defending rights, we rely on your consent — and we let you withdraw it.
4.1. Selecting equipment, answering your questions, building a quote.
Data: conversations, kit contents, language, information about your own equipment. Basis: Article 4(9) PDPL — measures taken at your request with a view to concluding a contract.
4.2. Placing the order, reserving equipment, taking payment, handing over and taking back equipment.
Data: name, phone, email, delivery address, order contents, amounts, deposit.
Basis: Article 4(9) PDPL — performance of the contract with you.
4.3. Confirming that you are who you say you are before we hand over equipment.
Data: identity document and the fields read from it.
Basis: Article 4(9) PDPL. Under the Rental Terms, handover of equipment is conditional on identity verification — so verification is part of performing the contract, not an extra service. The transfer of the document image outside the UAE is a separate question — see section 8.
4.4. Issuing invoices, recording payments in our books, reporting to the tax authority.
Data: name or company name, TRN, email, phone, order contents and amounts.
Basis: Article 4(10) PDPL — obligations imposed on us by UAE law.
4.5. Recording equipment condition, resolving damage disputes, recovering losses.
Data: photos and video at handover and return, the text of the agreement you accepted, order correspondence, identity verification data.
Basis: Article 4(3) PDPL — establishing and defending legal claims.
4.6. Protecting your account and our system: sign-in log, new-device alerts, staff action log.
Data: IP fingerprint, device, time and method of sign-in.
Basis: Article 4(9) PDPL (secure access to your account is part of the service) and Article 4(3) PDPL (incident investigation and defence of rights).
4.7A. Gaffer orders, referral programme and payouts.
Data: the details of the gaffer's client entered by the gaffer, referral records, payout details.
Basis: Article 4(9) PDPL — performance of the gaffer or referral agreement with the person concerned. A gaffer who enters a client's details confirms that the client asked them to arrange the rental, so the client's data is processed to take steps at the client's request. Payout records are also kept under Article 4(10) PDPL (accounting obligations).
4.8. Sending news, offers and reminders about a quote you did not order.
Data: Telegram ID, email, order history.
Basis: your consent only (Article 6 PDPL). We do not send these messages unless you have switched them on, and you can switch them off at any time.
Service messages are sent as part of performing the contract or the programme you joined (Article 4(9) PDPL): order confirmation, invoice, return reminder, document check result, account sign-in alert, one request for feedback after a completed rental, a single "shall we continue?" message in a conversation you started and left within the last hour, notices about your referral credits and rewards, changes to the referral programme rules, and a reminder that your company's trade licence is about to expire. You can switch off the feedback request and the "shall we continue?" message in your settings; the others are needed to perform the contract.
5. IDENTITY DOCUMENTS
This is the most sensitive part, so we describe it in detail.
5.1. Why we ask for a document.
We hand over equipment worth from several thousand to several hundred thousand dirhams. Identity verification is the condition on which we are prepared to do that: without it we could neither recover the equipment nor bring a claim if something goes wrong.
Identity verification for camera equipment rental is not required by UAE law — it is our own commercial condition, which is exactly why it is written into the Rental Terms as a condition of handover. You may decline to provide a document, but then we cannot hand over equipment.
5.2. What happens to the file.
You upload a photo or PDF of the document in your account area or in the bot. We do not keep the file of a personal identity document on our own server. It is passed on:
- to Telegram: every page is sent to our company's Telegram chat, where our staff member checks it. Our system keeps only the Telegram reference to the file, so that the image can be shown again on the order card. If you sent the document through the bot, it also stays in your own chat with the bot;
- to Anthropic (USA), only if you tick the separate box "send the image to Anthropic to read the fields". Their model reads the document fields and flags signs that the image may be forged. Without that box ticked, the image is not sent outside the UAE and our staff member enters the fields manually. Checking may then take a little longer.
We have to say this plainly: a copy of your document stays in Telegram's infrastructure and in our company's chat. We have no technical means of making Telegram delete that file.
Company documents (trade licence, and for framework agreements the signed agreement, authorisation letters and the name, position and masked document number of the signatory and any guarantor; we do not keep copies of their identity documents) are stored as files on our server in a closed directory that only the system and the owner of our company can access. A trade licence is not sent to an artificial intelligence model; our staff member enters its fields manually.
5.3. Who sees it.
- The company owner — in full, including the document number.
- Staff — only the last 4 characters of the number, shown as "•••• 1234".
- Partners, gaffers and referrers — do not see documents at all.
5.4. Who makes the decision.
Artificial intelligence only reads the fields and highlights suspicious signs. The decision to accept or reject a document is made by a human — our staff member; in some cases we also ask you to confirm the recognised data yourself via a link. No document is rejected automatically.
One rule works automatically: the system does not allow equipment to be handed over if your identity has not been verified or your document has expired. This follows from the Rental Terms and applies to everyone in the same way. Only the company owner or a designated senior staff member can lift the block for a particular order, and each such decision is recorded with the name of the person and the reason.
If you were refused and believe it was a recognition error, write to [email protected] and we will review the decision with human involvement. This is your right under Article 18(4) PDPL.
5.5. How long this is kept — see section 9.
5.6. Passport left as a deposit.
Instead of a cash deposit you may leave your passport with us for the rental period. We keep the physical passport in a safe and do not copy it for this purpose. In the order we record the issuing country, the last 4 characters of the number, the time we received and returned the passport, the receipt number, and who collected it (you or the person you named). We return the passport when the equipment is returned and checked.
6. ARTIFICIAL INTELLIGENCE, CONVERSATIONS AND PROFILING
Our consultant is a language model. You are entitled to know exactly what it receives.
6.1. What goes to Anthropic (USA), models of the Claude family:
- the text of your messages to the assistant in the bot and on the website;
- photos you send (location, equipment, references);
- context about you: the text of your past requests, the list of your own equipment, open requests to source equipment;
- your name and shoot brief, when we prepare a personal covering note for a payment;
- our staff's notes on the condition of returned equipment, which the assistant rewrites into a message to you without adding facts;
- images of identity documents — only if you tick the separate box (section 5).
6.2. What goes to OpenAI (USA): the voice messages you send to the bot, in full, as audio files, for transcription into text. We have no speech recognition of our own.
6.3. What is not passed into the conversation stream: your phone number, email address, delivery address and bank card details. In the website chat, before you sign in, you appear under a technical pseudonym of the form "web:<session id>", with no link to your name.
6.4. No profiling.
We do not build profiles of clients and do not rate conversations automatically. This section is about the assistant. Google Ads audiences of site visitors who accepted advertising cookies are described in section 14.
6.5. Humans read the conversations.
Your dialogue with the assistant is stored and may be viewed by our staff, including in real time, so that we can step in if the bot answers incorrectly and so that we can handle complex requests. This also applies to anonymous conversations on the website before sign-in. Every such viewing is written to a service log.
6.6. Automated decisions.
Accepting or rejecting a document, refusing to rent, and setting individual deposit terms are decisions made by a human. Some things are calculated by fixed rules that apply to everyone in the same way and do not depend on who you are:
- prices and the standard deposit, from the catalogue and the contents of the order;
- whether an order must be handed over with our technician, by the replacement value of the kit;
- the handover block when identity is not verified or the document has expired (section 5.4);
- referral rewards: one invited person counts for one referrer, repeated clicks from the same device are counted once a day, and there is an annual limit on cash rewards;
- a temporary sign-in block after repeated failed attempts.
You have the right to require human involvement in reviewing the result of any automated processing (Article 18(4) PDPL).
7. WHO WE SHARE DATA WITH
We do not sell data. Data goes only to those without whom the service does not work, and to Google for analytics and advertising if you accept this in the cookie notice (section 14). Everyone listed below is a commercial contractor, not a government body.
Anthropic PBC — USA.
Receives: the text of your conversations with the assistant, the photos you send, the list of your own equipment, your name and shoot brief in the covering note for a payment; and, only if you tick the separate box, images of identity documents.
Purpose: operating the AI consultant and reading document fields.
OpenAI — USA.
Receives: voice messages sent to the bot.
Purpose: transcribing speech into text.
Telegram — international infrastructure.
Receives: all conversations in the bot, document files, notifications containing your name and order amounts.
Purpose: delivering messages and files.
Stripe — USA and Ireland.
Receives: email address, order number, the list of equipment in the payment description; you enter your card details directly with them, not with us.
Purpose: taking payment, placing the authorisation hold for the deposit (including on the card you saved with Stripe when paying), issuing the payment document.
Zoho Books (Zoho Corporation) — USA.
Receives: your name or company name, phone, email, TRN, order contents, dates and amounts; for gaffer and referral payouts, the payee's name and the amount paid.
Purpose: bookkeeping and invoicing.
Google — USA.
Receives: working spreadsheets containing orders (name, Telegram ID, contents, amounts), feedback and details of your own equipment; your account data when you sign in with Google; database backups in Google Drive.
Purpose: working catalogue and records, account sign-in, backups.
Also receives Google Analytics and Google Ads data, only if you accept them in the cookie notice (section 14).
Dropbox — USA.
Receives: database backups.
Purpose: backups.
Hetzner Online GmbH — Germany.
Receives: all service data — this is the server the system runs on.
Purpose: hosting the service.
Email service provider.
Receives: your address and the contents of the emails we send you.
Purpose: delivering order confirmations, invoices and sign-in links.
Partners — equipment owners, UAE.
Receive: your name and phone number, and only for the order in which their equipment is involved.
Purpose: coordinating handover and return.
Gaffers — UAE.
Receive: the details of their own clients that they entered themselves, and the orders they placed and their status.
Purpose: managing the orders they arranged.
The person who invited you, if you came through a referral link.
Receives: a notice that an order was placed and paid under their code, and the amount of their reward. They do not receive your contact details or the contents of your order. Purpose: operating the referral programme.
Our bank — UAE.
Receives: payments you send by bank transfer, and gives us the payer's name, amount and reference so that we can match the payment to your order.
Purpose: receiving payments.
In addition, a limited data set (name, company, TRN, company address, email, phone, language, document verification status, order amounts and dates) is transferred regularly within our own server to the accounting layer and the client records system. Document numbers, recognition results and internal notes are not included in that transfer.
We will disclose your data if required to do so by a court or a competent UAE government authority. That is a separate legal basis for processing (Article 4(3) PDPL), not an exception to the list above: commercial transfers to contractors do not fall under it and are listed separately.
8. TRANSFERS OF DATA OUTSIDE THE UAE
Some of the recipients in section 7 are located outside the United Arab Emirates — in the USA, Ireland and Germany. This means your data leaves UAE territory.
The bases for those transfers under Article 23 PDPL are:
- Article 23(1)(a) — data processing agreements with recipients obliging them to adopt the measures, controls and requirements set out in the PDPL;
- Article 23(1)(b) — your separate, explicit consent to transfer your data outside the UAE. It is requested separately from your acceptance of the Rental Terms, names the recipients and countries, and can be withdrawn at any time;
- Article 23(1)(d) — for Stripe and the email service provider, the transfer is necessary to conclude and perform the contract with you: without them there can be neither payment nor delivery of invoices and sign-in links.
One point separately, about the most sensitive flow. We do not rely on "necessary for performance of the contract" for images of your documents: the fields can be read without an external model. The document image is therefore transferred outside the UAE only with your separate, explicit consent (Article 23(1)(b)). If you have not given it, or have withdrawn it, our staff member enters the fields manually.
Data from Google Analytics and Google Ads goes to Google in the USA only with your explicit consent (Article 23(1)(b)), given with "Accept" in the cookie notice.
We do not rely on any country being recognised as adequate: as at the date of this policy there is no decision of the UAE Data Office listing such countries.
From 1 July 2027, electronic invoices issued to legal entities and the data associated with them must be stored within the UAE (Ministerial Decisions No. 243 of 2025 and No. 244 of 2025). Invoices to individuals are not yet within the electronic invoicing system. We will update this section when the relevant data is moved.
9. HOW LONG WE KEEP DATA
We keep different data for different periods, because they serve different purposes. Personal data is not kept once the purpose of processing has been exhausted (Articles 5(3) and 5(7) PDPL).
- The identity document image and the link to the file: the link is cleared as soon as verification is complete. The copy left in Telegram's infrastructure is outside our control (section 5).
- The full AI output for the document: stored encrypted and cleared when the order is closed.
- The fact and status of verification, document type, last 4 characters of the number, and document expiry date: 3 years from the date of the last order. The period reflects possible claims in tort (Article 4(3) PDPL; UAE Civil Code, Federal Decree-Law No. 25 of 2025, Article 258).
- Orders, invoices, payments, handover and return records, records of acceptance of the Terms and of the consents you gave: 7 years after the end of the tax period they relate to (Corporate Tax Law No. 47 of 2022, Article 56). The period is extended by up to 4 further years in the event of a tax audit or a tax dispute (Cabinet Decision No. 74 of 2023, Article 3(2)).
- Conversations with the assistant in the bot: 24 months from the last message. In the website chat: deleted together with the website session after 30 days of inactivity.
- Video of equipment condition: 90 days from recording. Photos of equipment condition: 365 days from recording. If an item was recorded as damaged or missing, the records of that handover are kept for 3 years after the order is closed.
- Passport left as a deposit: the record forms part of the order and is kept with it.
- Payout details (including the IBAN) and payout records: with the accounting records, 7 years as above.
- Passkeys: until you delete them or close your account; revoked passkeys are deleted 30 days after revocation.
- Referral link clicks: 400 days.
- Outgoing message queue: 30 days.
- Records of an invitation email sent to you by our staff: 12 months.
- Technical records of assistant usage linked to your account (number of requests and cost, without the text): 24 months.
- Website sessions, basket, website chat history: 30 days of inactivity.
- Revoked sessions: 7 days after revocation.
- Account sign-in log, including failed attempts: 180 days.
- Service records of sign-in link requests: 90 days.
Database backups are kept for 30 days on rotation, including with the recipients listed in section 7. Deletions from the main database propagate into backups as those backups rotate.
10. YOUR RIGHTS AND HOW TO EXERCISE THEM
Under the PDPL you have the following rights.
10.1. To know what data we process, why, who we share it with inside and outside the UAE, how long we keep it, what safeguards we apply to cross-border transfers, and how to complain (Article 13). Part of that information is in this document; the rest you can request.
10.2. To receive a copy of your data in a structured, machine-readable format and to ask us to transfer it to another controller where technically feasible (Article 14).
10.3. To correct inaccurate data and complete incomplete data (Article 15).
10.4. To have your data deleted (Article 15). Limitation: we will not delete what we are required to keep under UAE tax law — orders, payments, invoices and related documents. Everything else — conversations, contact details, identity verification data beyond the mandatory period — we will delete.
10.5. To restrict processing, for example while we investigate an objection you have raised (Article 16). We may continue simply to store the data.
10.6. To object to processing, in particular to news and offers (Article 17).
10.7. To object to decisions based on automated processing and to require human involvement in reviewing them (Article 18).
10.8. To withdraw consent at any time — to news and offers, to sending your document image outside the UAE, and to analytics and advertising cookies (Article 6(1)). Withdrawal does not make unlawful what was done before it. Withdrawing consent to transfer your document image outside the UAE does not stop you renting: our staff member will enter the document fields manually.
10.9. To complain to the UAE Data Office (Article 24) if you believe we are infringing your rights.
How to exercise them. Write to [email protected] with the subject "Personal data request", or use the support button in your account area. Tell us what you want and from which email address or Telegram account you are registered with us.
So that we do not hand your data to someone else, we will ask you to confirm that the request comes from you: normally it is enough that the message came from the address linked to your account, or that the request was made from your account area.
Response time: we respond without undue delay and undertake to do so within 30 days. If the request is complex, we will tell you and extend the period by a maximum of a further 30 days. This is a voluntary undertaking on our part: UAE law does not set a specific deadline for the controller.
There is no charge for handling a request.
11. CONSENTS: WHICH ONES THERE ARE AND HOW TO WITHDRAW THEM
We ask you for three separate consents. Each one is given and withdrawn separately, and accepting the Rental Terms is not, by itself, any of them. All three are off until you switch them on.
- Consent to send the image of your identity document to Anthropic (USA) to read its fields. You give it by ticking the box when you upload the document. Withdrawal: in your account settings or by email to [email protected]; after that our staff member checks your documents manually.
- Consent to news, offers and reminders about a quote you did not order. Withdrawal: in your account settings, in the bot settings, via the unsubscribe line in the message, or by email.
- Consent to Google Analytics and Google Ads cookies. You give it with "Accept" in the cookie notice. Withdrawal: the "Cookie settings" link at the bottom of every page (section 14).
We keep a record of which consent you gave, when, and against which version of the text — Article 6(1)(a) PDPL requires this, and it also protects you: you can always ask us for a copy.
12. MESSAGES WE SEND YOU
- News, offers and reminders about a quote you did not order are sent only with your consent, only between 09:00 and 18:00 Dubai time, and each carries a way to unsubscribe.
- Service messages (section 4.8) are not stopped by unsubscribing from news and offers: without them we cannot perform the contract. The feedback request and the "shall we continue?" message can be switched off in your settings. If you do not want to receive anything from us at all, that means closing your account.
13. HOW WE PROTECT DATA
- Channel encryption: all traffic with the website and the bot goes over HTTPS.
- Encryption in the database: the identity document number, the result of reading it, and two-factor authentication secrets are stored encrypted.
- Access separation: only the company owner sees the full document number; staff see the mask "•••• 1234". Viewing a client's conversation is a separate permission, and every time a dialogue is opened it is written to a log.
- Two-factor authentication is mandatory for every staff member with access to the administrative part.
- We do not store your IP address. Instead we store an irreversible fingerprint — a hash of the address with a secret key, from which the address itself cannot be recovered. It is used to tell a sign-in from a familiar device from a sign-in from a new one. One exception: when a partner accepts the partner agreement, we store the IP address and browser string together with the accepted text, as evidence of acceptance (Article 4(3) PDPL).
- Passkeys: we store only the public key; it cannot be used to sign in without your device.
- Photos of equipment condition are stored in a closed directory outside the public part of the site and served only on an authorised request.
- Staff action log: every change of data in the administrative part is recorded.
- New-device sign-in alerts reach you immediately.
- Backups run daily, on rotation.
What we do not hide: your phone number, email address, tax registration number, delivery address and conversations are stored in the database in plain form. That is a deliberate decision — they are needed for search, calls and emails. They are protected by access separation, channel encryption and the security of the server itself, rather than by field-level encryption.
If there is a breach. If personal data is compromised, we will notify the UAE Data Office and, where the breach affects your privacy and the security of your data, you personally (Article 9 PDPL). We will tell you what happened, which data is affected, what the possible consequences are, and what we have already done. The specific notification deadlines are to be set by the PDPL Executive Regulations; as at the date of this policy they have not been issued, so we undertake to notify without delay after discovery.
14. COOKIES AND ANALYTICS
Without your consent, the site sets only our own cookies, and each is needed for the site or for a service you asked for:
- sid — your session identifier: sign-in, basket, chat history, selected language. Not accessible to page scripts. Lifetime: 30 days.
- csrf — protects forms against request forgery. Lifetime: 30 days.
- ref — only if you open a referral link: the referral code, so that you get the discount for invited clients and the person who invited you is credited. Not accessible to page scripts. Lifetime: up to 60 days.
- consent — your choice in the cookie notice (analytics yes or no, advertising yes or no) and when you made it, and a random identifier that links your choice to the record on our server; it does not show who you are. Page scripts can read it, so that the notice knows your choice. Lifetime: 6 months.
The site also keeps in your browser the address to return to after sign-in (until you close the tab) and a mark that you have seen a notice in your account area. Neither contains personal data.
Google Analytics and Google Ads (only with your consent). When you first open the site, a notice asks whether you accept analytics and advertising cookies. If you click "Decline" or close the notice, no Google script loads and nothing is sent to Google. If you click "Accept", we turn on Google Analytics and the Google Ads conversion tag. They send Google the pages you open on this site and the time of each visit. They also send your browser and device type, your approximate location based on your IP address, the page that brought you here, and whether you placed an order after clicking our ad. Google sets its own cookies for this (_ga, _ga_*, _gcl_*). We use this to see which pages work and which ads bring orders, and to show our ads again to people who visited the site. We do not send Google your name, email, phone number, order contents or payment details, and we do not link analytics to your account. Google Analytics keeps this data for 2 months; advertising audiences of site visitors are kept for up to 180 days. Google also uses this data under its own privacy policy.
We remember your choice in your browser for 6 months (the consent cookie above) and keep a record of it on our server (the date, the choice and the version of this policy, without your name or IP address) so that we can show that consent was given. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. If you withdraw consent, Google scripts stop at once and we delete their cookies from your browser. Withdrawing does not affect what happened before.
These cookies are not needed for the site to work, so we ask first (Articles 4 and 6 PDPL). We have no Meta Pixel, Yandex Metrica, Hotjar or other counters, ad pixels or trackers.
The sign-in page loads a Telegram widget from Telegram's servers — when you open that page, Telegram sees your IP address. Apart from this and Google scripts after your consent, there are no third-party scripts on the site.
15. AGE
The service is intended for adults. Under UAE law, full legal capacity is reached at 18 (Civil Code, Federal Decree-Law No. 25 of 2025, Article 84). We do not enter into rental agreements with minors and we do not direct the service at children.
When you place an order we ask you to confirm that you are 18 or over, and before handover we check the date of birth in the document you presented. If it turns out that you are under 18, we will refuse handover and refund everything paid in full.
If you are a parent or legal guardian and believe we are processing a child's data, write to [email protected] and we will delete it.
16. IF YOU ARE OUTSIDE THE UAE
We are based in the UAE, we provide the service physically in the UAE, we quote prices in dirhams, and we do not advertise outside the UAE. We apply UAE law to the processing of data.
The same set of rights set out in section 10, the same response time and the same contact channel apply to all our clients regardless of where you are when you place an order.
17. STAFF AND PARTNER DATA
If you work with us as a staff member, partner, gaffer or referral partner, we process: your name, Telegram account, personal phone number (for the quick-call button), role and access rights, support requests, the log of your actions in the system and, for partners, gaffers and referral partners, additionally the company name, TRN, commercial terms, order contents, payout amounts and payout details, documents you upload to your account, and the logo and signature you provide for your documents. When a partner accepts the partner agreement, we also keep the IP address and browser string of that acceptance (section 13).
The basis is performance of our contract with you (Article 4(9) PDPL) and defence of rights and system security (Article 4(3) PDPL). The action log exists so that an incident can be investigated and it can be established who did what with client data. The rights in section 10 apply to you in the same way.
18. CHANGES TO THIS POLICY
This is the first published version of this policy. It replaces clause 12 of the Rental Terms, which described data processing incompletely and did not disclose transfers of data to contractors outside the UAE.
We will change this policy when the system changes. Every version carries a date, shown at the start and at the end of the document. We will give advance notice of material changes — a new recipient of data, a new purpose of processing, a change of retention periods — in the bot, in your account area, or by email. Previous versions are available on request.
19. HOW TO CONTACT US
For personal data questions, requests and complaints: [email protected]
General questions and support: [email protected], Telegram @rent_beartpro_bot, or the "Support" button in your account area.
Postal address:
Raised by Future Records FZE
Office 1309, Creative Tower, Fujairah, United Arab Emirates
If our answer does not satisfy you, you have the right to complain to the UAE Data Office.
This policy describes data processing in the BeART Rentals system as at the version date. If you find a discrepancy between this text and what actually happens, tell us and we will correct either the text or the system.
Version of 26 October 2026.