Last updated: October 19, 2026
Your privacy matters to us. This Privacy Policy explains what personal data Bed N Beds collects when you use bednbeds.com, why we collect it, who we share it with, how long we keep it and the choices and rights you have. We have tried to write it in plain language, and we describe the actual tools our website uses rather than hiding behind general statements.
1. Who We Are and Scope of This Policy
Bed N Beds (“Bed N Beds”, “we”, “us” or “our”) operates an online short-stay booking platform that connects guests with hosts of apartments, houses, condos, lofts and bed & breakfast rooms. We also sell add-on travel and hosting services, such as airport transfers, desert safaris, dhow dinner cruises, welcome packs, professional cleaning and listing photography. Our head office is in Dubai, United Arab Emirates.
For the purposes of data protection law, Bed N Beds is the controller of the personal data described in this policy, meaning we decide why and how it is processed. Where a host receives your details to manage your stay, that host also acts as an independent controller for the data it holds and uses.
This policy applies to personal data we process when you visit our website, create an account, send a booking request, purchase a service through our shop, list a home as a host, subscribe to our updates or contact us. It should be read together with our Terms & Conditions and our Cookie Policy.
2. Personal Data We Collect
We collect only the information we need to run the platform, deliver what you ask for and keep the site secure. The categories below describe what we may collect depending on how you use Bed N Beds.
2.1 Account information
When you create an account, whether as a guest or as a host, we collect your name, email address, password (stored in hashed form, never in plain text), and any optional details you add to your profile, such as a phone number, billing address or profile description. Hosts additionally provide listing details such as the property address, description, house rules, amenities, photos, pricing and availability.
2.2 Booking information
When you send a booking request, we collect the listing you are interested in, your check-in and check-out dates, the number of guests, your name, email address, phone number and any message you write to the host or to us. Booking requests are stored in our website database and emailed to our team so that we can process them and coordinate with the host.
2.3 Purchase and payment information
When you buy a service through our shop (which runs on WooCommerce), we collect your billing name, billing address, email address, phone number, order contents, service dates, pickup or delivery details where relevant, and order history. Card payments are handled by the payment gateways we enable at checkout. Card numbers and security codes are entered into, and processed by, those payment processors; we do not store your full card number on our servers. We may receive limited information from the processor, such as the payment status, a transaction reference, the card type and the last four digits.
2.4 Communications
When you contact us through a contact form (powered by Contact Form 7), by email or by phone, we collect your name, email address, phone number if provided, the subject and content of your message, and any information you choose to share. Messages submitted through the website are stored in our database and emailed to our team. We may keep notes of phone calls relating to bookings, complaints or support requests.
2.5 Technical and security information
When you visit the website, our servers and security tools automatically process technical data, including your IP address, browser type and version, device type, operating system, referring page, pages requested, and the date and time of each request. Our security plugin, Wordfence, operates as a web application firewall and processes IP addresses and request details to detect and block malicious traffic, brute-force login attempts and other attacks.
2.6 Cookies and browser storage
We use cookies that are strictly necessary for the site to work (for example, to keep you logged in, keep your cart contents and remember your cookie choices) and, only with your consent, optional cookies. Our consent banner is provided by CookieYes. Separately, the website stores your favourites, comparison list and recently viewed homes in your browser’s localStorage. This information stays on your device and is not sent to our servers. Full details are in our Cookie Policy.
2.7 Map views
Listing pages can display a map, but map tiles from OpenStreetMap are loaded only after you click “Show map”. When you do, your browser connects to OpenStreetMap tile servers, which receive your IP address and standard request information so that the map can be displayed. If you do not click “Show map”, no request is made to OpenStreetMap.
2.8 Information from other sources
We may receive information about you from hosts (for example, if a host reports a problem with a stay), from payment processors (for example, confirmation that a payment succeeded or was disputed), and from public authorities where the law requires.
2.9 Sensitive data
We do not ask for sensitive personal data, such as health information, religious beliefs or biometric data. Please do not include such information in messages unless it is genuinely needed, for example to request an accessibility accommodation. If you do, we will use it only to help with your request.
3. How We Use Your Data and Our Legal Bases
We use personal data only where we have a valid reason under applicable law. The table below summarises our main purposes and the legal bases we rely on under the EU and UK General Data Protection Regulation (GDPR). Under the UAE Personal Data Protection Law, we rely on comparable grounds, including your consent, performance of a contract with you, and compliance with legal obligations.
| Purpose | Examples | Legal basis |
|---|---|---|
| Providing the platform | Creating and managing accounts, displaying listings, saving your preferences | Performance of a contract |
| Processing bookings | Handling booking requests, sharing details with the host, confirming stays | Performance of a contract |
| Selling services | Processing shop orders, arranging transfers, tours, cleaning or photography | Performance of a contract |
| Payments | Taking payment, issuing refunds, handling chargebacks | Performance of a contract; legal obligation |
| Customer support | Answering messages, resolving complaints and disputes | Performance of a contract; legitimate interests |
| Security and fraud prevention | Firewall protection, blocking attacks, detecting suspicious bookings | Legitimate interests; legal obligation |
| Service messages | Booking confirmations, policy updates, account notices | Performance of a contract; legitimate interests |
| Marketing | Newsletters, travel inspiration, offers | Consent (or legitimate interests where permitted for existing customers) |
| Optional cookies | Functional, analytics, performance or advertisement cookies | Consent |
| Legal compliance | Tax and accounting records, responding to lawful requests | Legal obligation |
| Improving the site | Understanding which pages are useful, fixing errors | Legitimate interests; consent where cookies are involved |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. Our legitimate interests include keeping the platform secure, preventing fraud, improving our services and responding to enquiries. You may object to processing based on legitimate interests at any time, as described in Section 9.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our security firewall may automatically block traffic that looks malicious; if you believe you have been blocked in error, please contact us.
4. How We Share Your Data
We do not sell your personal data for money. We share personal data only as described below and only to the extent needed.
4.1 Hosts
When you send a booking request or make a booking, we share the details the host needs to review and manage your stay, such as your name, dates, number of guests, contact details and any message you include. Hosts use this information under their own responsibility and must comply with applicable data protection laws. Some hosts may be legally required to register guest details with local authorities.
4.2 Guests
If you are a host, information in your listing is publicly visible, and we share the contact and check-in details a confirmed guest needs to complete their stay.
4.3 Service providers
We use carefully selected providers who process data on our behalf and under our instructions, including website hosting and server providers, email delivery services, security services (Wordfence, provided by Defiant, Inc., which may receive IP addresses and request data to check them against threat intelligence), our cookie consent provider (CookieYes), and partners who deliver the add-on services you purchase, such as transfer drivers, tour operators, cleaning teams and photographers. These providers are only given the data needed to perform their tasks.
4.4 Payment processors
Payments are processed by the payment gateways enabled in our WooCommerce checkout, such as card payment processors. They collect and process your payment details directly, under their own privacy policies and industry security standards such as PCI DSS, and they share with us only the information needed to confirm and reconcile your payment.
4.5 Map provider
If you click “Show map”, your browser requests map tiles directly from OpenStreetMap servers, which receive your IP address. This sharing happens only at your request.
4.6 Authorities and legal requirements
We may disclose personal data to courts, police, tax authorities, tourism regulators or other public bodies where we are required to by law, to respond to valid legal process, to protect the safety of our users or the public, or to establish, exercise or defend legal claims.
4.7 Business transfers
If Bed N Beds is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the new owner, who will be bound to respect this policy or to give you notice of any changes.
5. International Data Transfers
Bed N Beds is based in the United Arab Emirates, and our homes and partners are located in several countries, including the United States. Our hosting, email, security and payment providers may process data in other countries as well. As a result, your personal data may be transferred to and processed in countries other than the one you live in, which may have different data protection rules.
When we transfer personal data internationally, we take steps to protect it as required by applicable law. For transfers of data protected by the GDPR or UK GDPR to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum, or on a legal exception such as the transfer being necessary to perform a booking contract you requested. For transfers out of the UAE, we follow the cross-border transfer rules of the UAE Personal Data Protection Law. You can contact us to request more information about the safeguards we use.
6. How Long We Keep Your Data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, tax, accounting and reporting requirements. When data is no longer needed, we delete it or anonymise it.
| Data | Typical retention period |
|---|---|
| Account information | For as long as your account is active, then up to 24 months after closure unless needed for open bookings, disputes or legal obligations |
| Booking requests that do not proceed | Up to 24 months after the request |
| Confirmed bookings, orders and invoices | As long as required by applicable tax and commercial record-keeping laws, typically at least five years |
| Payment references from processors | Together with the related order records |
| Contact form messages and support emails | Up to 24 months after the matter is closed |
| Security and firewall logs (including IP addresses) | Generally up to 90 days, longer if needed to investigate an incident |
| Newsletter subscription | Until you unsubscribe; we keep a minimal suppression record so we do not contact you again |
| Cookie consent record | Up to 12 months, after which we ask for your choice again |
| Favourites, compare list and recently viewed homes | Stored only in your browser until you clear them; never stored by us |
We may keep data for longer where we are required to by law or where it is needed to establish, exercise or defend legal claims.
7. How We Protect Your Data
We use technical and organisational measures appropriate to the risk to protect personal data against loss, misuse, unauthorised access, disclosure and alteration. These include encrypted connections (HTTPS) across the website, a web application firewall and login protection through Wordfence, hashed passwords, restricted administrative access, regular software updates and backups, and the use of established payment processors so that full card details are not stored on our servers.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to affect your rights, we will notify you and the relevant authorities where the law requires. You can help protect your account by choosing a strong, unique password and keeping it confidential. Please never send card details by email or through a contact form, and read our Trust & Safety page and our guide on how to avoid vacation rental scams.
8. Marketing, Newsletters and Unsubscribing
If you subscribe to our newsletter or opt in to marketing, we may send you travel ideas, new homes, service offers and platform news. Where the law allows, we may send existing customers information about similar services, with a clear way to opt out each time.
You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by writing to [email protected]. Unsubscribing does not affect service messages that relate to your bookings, orders or account, such as confirmations, changes and important policy updates, which we need to send to perform our contract with you.
9. Your Rights
Depending on where you live, you have rights over your personal data. We respect these rights and will respond to requests within the time limits set by applicable law. We may need to verify your identity before acting on a request, and in some cases the law allows us to decline or limit a request, for example where we must keep data to comply with a legal obligation. Making a request is free, unless a request is clearly unfounded or excessive.
9.1 United Arab Emirates (PDPL)
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), and subject to its conditions and exceptions, you have the right to:
- obtain information about the personal data we process about you, the purposes of processing and who it is shared with;
- request a copy of your personal data and, where technically feasible, have it transferred to another controller;
- request correction of inaccurate data or completion of incomplete data;
- request erasure of your personal data where it is no longer needed or processing is unlawful;
- request restriction of processing in certain circumstances;
- object to or request that we stop processing, including for direct marketing;
- object to decisions based solely on automated processing that produce legal effects or seriously affect you; and
- withdraw your consent at any time, without affecting processing carried out before withdrawal.
You may also submit a complaint to the UAE Data Office if you believe your rights have been infringed.
9.2 European Economic Area and United Kingdom (GDPR)
If the EU GDPR or UK GDPR applies to our processing of your data, you have the right to:
- access your personal data and receive information about how we process it;
- rectify inaccurate or incomplete data;
- erase your data in certain circumstances (the “right to be forgotten”);
- restrict processing in certain circumstances;
- data portability, meaning to receive data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible;
- object to processing based on legitimate interests, and to object at any time to direct marketing;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects; and
- withdraw consent at any time where we rely on consent.
You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. In the UK, this is the Information Commissioner’s Office. We would appreciate the chance to address your concerns first, so please contact us.
9.3 California (CCPA/CPRA)
If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to our processing of your information, you have the right to:
- Know and access: request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we disclose it;
- Delete: request deletion of personal information we collected from you, subject to legal exceptions;
- Correct: request correction of inaccurate personal information;
- Opt out of sale or sharing: we do not sell personal information and do not share it for cross-context behavioural advertising. If we ever enable advertisement cookies, they will be off by default and you can keep them off through the “Cookie settings” link in our footer. Where required, we treat a Global Privacy Control signal from your browser as a valid opt-out request;
- Limit use of sensitive personal information: we do not use or disclose sensitive personal information for purposes that would give rise to this right; and
- Non-discrimination: we will not deny you services, charge you different prices or provide a different quality of service because you exercised your privacy rights.
In the past 12 months, the categories of personal information we have collected are those described in Section 2: identifiers (such as name, email address, IP address), customer records (such as billing address and phone number), commercial information (such as bookings and orders), and internet or network activity (such as security logs). Your favourites, compare list and recently viewed homes are kept only in your own browser and are not collected by us. We disclose these categories for business purposes to the recipients described in Section 4. You may use an authorised agent to submit a request on your behalf; we may ask for proof of the agent’s authority and verify your identity directly.
9.4 Other locations
If you live elsewhere, you may have similar rights under your local law. Please contact us and we will consider your request in line with the law that applies to you.
9.5 How to exercise your rights
To make a request, email [email protected] with the subject line “Privacy Request”, tell us which right you wish to exercise and give us enough information to identify your account or bookings. You can also use our contact form. Logged-in users can update much of their account information directly in their account area. You can change your cookie choices at any time through the “Cookie settings” link in the footer.
10. Children’s Privacy
Bed N Beds is not directed to children. You must be at least 18 years old to create an account, make a booking or purchase a service. We do not knowingly collect personal data from children under 18, except where a parent or guardian provides limited details, such as the number or ages of children travelling, as part of a booking they make. If you believe a child has given us personal data without appropriate consent, please contact us and we will delete it.
11. Third-Party Websites and Services
Our website may contain links to third-party websites, such as official tourism sites, map services or partner pages. This policy does not apply to those sites. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies before providing any personal data. Payment processors and OpenStreetMap process data under their own policies when you interact with them.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, the tools we use or the law. When we make changes, we will update the “Last updated” date at the top of this page. If the changes are significant, we will take reasonable steps to let you know, for example by a notice on the website or an email to account holders. We encourage you to review this page periodically.
13. Contact Us
If you have questions about this policy or how we handle your personal data, or if you want to exercise your rights, please get in touch:
- Bed N Beds, Dubai, United Arab Emirates
- Email: [email protected] (subject: “Privacy Request”)
- Phone: +971 55 555 5555 (Sunday to Thursday, 9:00 to 18:00 GST)
- Online: Contact form
We aim to acknowledge privacy requests promptly and to respond in full within the period required by applicable law.