Privacy Policy
Last updated: 12 July 2026
This Privacy Policy explains how Best of B Online FZ-LLC ("Best of B Online", "we", "us"), the RAKEZ-registered UAE company that operates the Best of Bedz website at bestofbedz.com (the "Site"), collects, uses, shares and protects your personal data when you browse, book or stay with us. Because we welcome guests from around the world, we apply the EU General Data Protection Regulation (GDPR) as our baseline standard, alongside the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for the stay itself, Egypt's Personal Data Protection Law (Law No. 151 of 2020).
1. Who is responsible for your data
Data controller (Site operator and booking counterparty): Best of B Online FZ-LLC, a Free Zone Limited Liability Company, Ras Al Khaimah Economic Zone (RAKEZ), UAE. Registered office: FDBC1018, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, UAE. RAKEZ licences: Media Licence No. 17004777 (online booking platform), Commercial Licence No. 5031600 (property management services), Services Licence No. 47018183 (marketing management).
Property operations (your stay and local guest registration): Your stay is delivered by our local operating company or partner in the country where the property is located (each a "Local Operator"), which receives the data needed to deliver the stay and to meet that country's guest-registration obligations. For properties in Egypt, the Local Operator is currently Eleven Seasons, New Cairo, Egypt (commercial register No. 237149, tax registration No. 764339486). The listing and your confirmation identify the Local Operator for your stay.
Privacy contact: privacy@bestofbedz.com · Guest services: cs@bestofbedz.com
2. What we collect
| Category | Examples | When |
|---|---|---|
| Identity | Full name | At booking |
| Contact | Email, phone or WhatsApp number, country | At booking |
| Support conversations | What you write to us by email or WhatsApp, and our replies | When you contact us |
| Government ID | Passport or national ID number | At check-in (Egyptian guest-registration requirement) |
| Booking | Property, dates, guest count, special requests | At booking |
| Payment | Transaction reference and payment status. We never see or store your full card number; cards are handled entirely by our licensed payment partners | At payment |
| Stay | Check-in and check-out records, in-stay messages | During your stay |
| Reviews | Ratings and review text you submit after a stay | Post-stay, if you submit |
| Technical | IP address, browser and device type, pages viewed | Automatically, on visit |
Data about your co-travelers. When you book for a group, you give us personal data about the people traveling with you (names for the booking, and IDs at check-in where the law requires registration). Only provide it with their knowledge, and please point them to this policy: we process their data exactly as we process yours, and you are responsible for informing them.
We do not knowingly collect data revealing health, religion, or other special categories, and we ask you not to include such information in messages or special requests.
3. Why we process it
| Purpose | Legal basis (GDPR reference) | Kept for |
|---|---|---|
| Quoting, booking and delivering your stay | Contract, Art. 6(1)(b) | Booking + 6 years |
| Guest registration with the Egyptian authority | Legal obligation, Art. 6(1)(c) | As required by law |
| Payment, refunds and fraud prevention | Contract + legitimate interest | Booking + 7 years |
| Tax and accounting records | Legal obligation | As required by tax law |
| Guest support and complaints | Contract | 3 years |
| Reviews you choose to publish | Consent | Until you ask us to remove it |
| Security and abuse prevention | Legitimate interest | 12 months |
| Marketing emails (only if you opt in) | Consent | Until you withdraw it |
We do not use your data for automated decisions that produce legal effects about you. Automated fraud screening runs at our licensed payment providers as part of processing a payment; any decision by us to decline a booking is made by a person.
4. Who we share it with
- The Local Operator for your stay (for Egypt properties: Eleven Seasons): booking and stay data needed to deliver the property, manage check-in and check-out, and file the guest registration required by the law of the property's country.
- Payment providers (independent controllers): your payment is entered directly on the PCI-DSS-compliant hosted page of a licensed payment provider, currently Ziina (licensed by the Central Bank of the UAE) or Mamo Pay (regulated by the DFSA), or any successor licensed provider we appoint. The provider collects your payment data as an independent data controller under its own privacy policy; we receive only limited transaction data (name, amount, currency, timestamp, card scheme and last four digits, payment status), and we share the booking details needed to process the payment, prevent fraud and handle refunds and disputes. The provider may process payment data outside the UAE under its own safeguards, and, as a regulated payment firm, retains transaction records for the periods its regulator requires. If a payment is disputed (a chargeback), we share the records needed to resolve it with the provider and the card network: the booking confirmation, the policy shown before payment, your recorded acceptance, and the technical data of the booking (such as the IP address it was made from).
- Property-management system: Guesty Inc. (United States), which hosts our booking records. Transfers are safeguarded as described in Section 5.
- Infrastructure and services: our database and booking records are stored with Supabase (hosted in the EU, Frankfurt); the Site runs on Vercel with Cloudflare in front of it; booking emails are sent through Resend (EU region); guest reviews are collected and verified through Revyoos; error monitoring, where enabled, uses Sentry.
- Maps: property pages embed Google Maps to show the location. When the map loads, Google receives your IP address and may set its own cookies under Google's privacy policy.
- Local registration authorities: guest-registration data (name and ID or passport) is filed with the competent authority of the property's country, as its law requires (in Egypt, the competent Egyptian authority).
- Tax authorities and professional advisers: where required by law, under confidentiality.
- Booking platforms: if your booking originates on an OTA (Airbnb, Booking.com, Expedia, Agoda, Trip.com), that platform processes your data as an independent controller under its own privacy policy.
- Analytics and advertising platforms (consent-gated): where our marketing pages run analytics (PostHog, Google Analytics) or advertising pixels (Meta, Snapchat, TikTok), those tools receive usage data only after you consent through the cookie banner, as described in the Cookie Policy. Where we run advertising, we may share hashed identifiers with ad platforms to build or exclude audiences; opt out any time at privacy@bestofbedz.com.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
5. International transfers
Your data moves between the UAE (where we operate the Site), the country where your property is located (where the Local Operator delivers your stay; currently Egypt), the EU (where our database and email providers are hosted) and the United States (where Guesty is based). We protect these transfers with EU Standard Contractual Clauses and the equivalent safeguards required by the UAE PDPL and the data-protection law of the property's country (in Egypt, Law 151/2020), and, where applicable, adequacy decisions. You can request a copy of the relevant safeguards at privacy@bestofbedz.com.
6. Security
Data is encrypted in transit (HTTPS everywhere), access to booking records is restricted and logged, card data never touches our servers (payments are PCI-DSS SAQ-A structured), and our infrastructure providers hold industry-standard certifications. No system is perfectly secure; if a breach affects your data we will notify you and the competent regulator within 72 hours where the law requires it.
7. Your rights
Subject to the law that applies to you, you may: access your data; correct it; ask for erasure (subject to legal retention duties); restrict or object to processing; receive a portable copy; and withdraw consent at any time (for reviews and marketing). Email privacy@bestofbedz.com; we respond within 30 days, extendable to 60 for complex requests, free of charge for reasonable requests.
Complaints. We would appreciate the chance to resolve any concern first at privacy@bestofbedz.com. You may also complain to: the UAE Data Office (UAE residents), your local Data Protection Authority (EU/UK residents), or Egypt's Personal Data Protection Center (Egypt residents).
International guests. We serve guests and owners worldwide and honour the data-protection rights your own law grants you (for example US state privacy laws, Australia's Privacy Act, and similar regimes): make any request to privacy@bestofbedz.com and we apply the strongest protection that fits your case rather than asking you to cite the statute.
8. Cookies
The Site uses a small set of cookies described in our Cookie Policy, which also explains how to control them.
9. Children
The Site is not directed to anyone under 18 and we do not knowingly collect their data online. Details of children staying as part of a booking (count and ages, where needed for occupancy) are provided by the responsible adult who books.
10. Changes
We may update this Policy. Material changes are announced on the Site, and, if you hold a future booking, by email. The "Last updated" date above shows the current revision.
This Policy is published in English and Arabic; if the two versions differ, the English version prevails.
11. Contact
- Privacy: privacy@bestofbedz.com
- Guest services: cs@bestofbedz.com · WhatsApp +20 122 758 0022
- Controller: Best of B Online FZ-LLC, FDBC1018, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, UAE