Legal
Privacy Policy
Archived at /legal/privacy/v1.0/. This version is never overwritten in place.
01Who we are
Oasis Revenue Lab is a service line of Lux Oasis Advisory & Services LLC, a company registered in the Sharjah Free Zone (SHAMS), United Arab Emirates, licence number 2645909, TRN 104722180700003 ("we", "us", "our").
We provide revenue management services and an advisory AI agent to short-term rental operators.
For anything in this policy, contact info@luxoasisadvisory.com or WhatsApp +971 58 508 9283.
Lux Oasis Advisory & Services LLC and Lux Oasis Holiday Homes are two separate companies registered in the United Arab Emirates. Neither owns the other. Lux Oasis Holiday Homes holds a DTCM licence and operates a short-term rental portfolio in JBR, Dubai Marina and Downtown Dubai. It is our operating partner: the live operation in which our systems and methods are tested before they are offered to clients. Lux Oasis Advisory & Services LLC does not hold a DTCM licence and does not operate short-term rental accommodation.
02The two roles we act in
This matters because it decides who is answerable for what.
We are the controller for the personal data of the people we deal with: enquirers, clients, and the individuals at a client who use the service. That is the data described in section 3.1. This policy is our statement as controller.
We are a processor for personal data that reaches us from inside a client's own systems, principally guest and reservation data visible in a property management system. We handle that on the client's written instructions under the Data Processing Addendum, and the client is the controller of it. If you are a guest of one of our clients and want to exercise rights over your data, contact the operator you booked with. We will support them in responding.
03What we collect
3.1 Data we collect as controller
- Name, email address, phone or WhatsApp number, Telegram handle or user identifier, and company name.
- Records of our communications with you by email, WhatsApp and Telegram, including the content of those messages.
- Your acceptance record: user identifier, email address, UTC timestamp, IP address and the version identifier of each legal document you accepted.
- Portfolio and business information you give us: listings, rates, costs, occupancy, revenue goals, floor prices and building information. Most of this is business information rather than personal data, but where a listing is held in an individual's own name it can identify that person.
- Billing details: invoice records and bank transfer references. We do not collect or store payment card details.
- Technical data generated while providing the service, such as message logs and system records of what the agent read and sent.
3.2 Data we handle as processor
Where you connect a property management system, we may see reservation records containing guest names, contact details, stay dates, rates and booking channel. We do not need guest identity data to price a listing, and we do not use it for that. Where we can limit an integration so that guest identity fields are not retrieved, we will. What we actually process for each client is set out in the Annex to the Data Processing Addendum.
3.3 What we do not collect
- We do not collect payment card details.
- We do not run analytics on our website and we do not set cookies on it. See the Cookie Policy.
- The floor price calculator on our website runs entirely in your browser. The figures you type into it are not sent to us or to anyone else, and are not stored.
- Our services are not directed at children and we do not knowingly collect their data.
04Why we use it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Providing the services, including daily briefings, alerts, analysis and answering your questions | Sections 3.1 and 3.2 | Performance of our contract with you |
| Configuring and managing your pricing engine and other connected accounts, where you have bought that service | Portfolio data, connected account access | Performance of our contract with you |
| Responding to enquiries and sending the free calculators you ask for | Contact data | Your request, and our legitimate interest in responding to enquiries |
| Invoicing, collecting payment and keeping tax records | Contact and billing data | Legal obligation, and performance of our contract |
| Proving what you agreed to and when | Acceptance record | Our legitimate interest in maintaining an accurate contractual record |
| Keeping the service secure and investigating misuse | Technical data | Our legitimate interest in security |
| Improving our services | Aggregated and anonymised data only, as described in section 5 | Our legitimate interest in improving what we sell |
We do not sell your data. We do not use it for third-party advertising. We do not use it to price the properties of any other client against yours.
05Improving our services, and AI training
5.1 We use aggregated and anonymised information to improve our methods. Anonymised means the result does not identify you, your properties or your building and cannot reasonably be used to do so.
5.2 We do not give your data to any provider for the purpose of training their AI models. Where we send content to Anthropic for the agent to reason over, we do so through a commercial interface and rely on Anthropic's published terms as to model training. Those terms are Anthropic's, not ours, and we will tell you if they change in a way that affects this statement.
5.3 We will not use your identifiable data to train any model of our own without your prior written consent.
06Who we share it with
We share data with the sub-processors listed in the Sub-processor List, which names each provider, what it does and where it processes. That list is published at /legal/sub-processors/ and is part of this policy.
We also share data:
- with our professional advisers, where they need it and are under a duty of confidence;
- with a public authority, where we are legally required to;
- with a buyer or successor, if the business or part of it is sold, in which case we will tell you before it happens.
We do not share your data with other clients, and we do not share it with your competitors.
07Where your data is processed, and transfers out of the UAE
7.1 [PLACEHOLDER: the actual hosting and processing locations must be confirmed and stated here before publication. The current website says both that data is hosted on encrypted EU cloud infrastructure and that data is processed in the United Arab Emirates, five lines apart. Both cannot be the primary description. See Open Question 7.]
7.2 Whatever the primary location, some processing takes place outside the UAE, because several of our sub-processors are established outside it. The Sub-processor List states, for each one, where it processes.
7.3 We rely on the following to make those transfers lawful. Where the recipient is established in a jurisdiction that has not been the subject of an adequacy decision under UAE law, we rely on contractual protections in our agreement with that recipient and, where the recipient offers them, on the recipient's own standard data protection clauses. Where you are subject to the EU or UK GDPR in your own right, we will enter into the relevant standard contractual clauses with you on request.
7.4 We are honest about the limits of this. The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data provides for executive regulations, and the detailed transfer regime depends on them. We do not claim certainty about a regime that is not yet settled, and we do not claim to hold any adequacy finding or any certification. When the position is settled we will update this section and tell active clients.
7.5 We do not claim compliance with any data residency requirement that we have not verified against the rules in force.
08How long we keep it
| Data | Retention |
|---|---|
| Client data, including portfolio data and briefings | For the duration of the service and then three years |
| Data we hold as processor | Deleted or returned within 30 days of the end of the service, unless you ask for longer in writing. Where this conflicts with the three-year period above, this row governs, because that data is not ours to keep |
| Enquiries that do not become clients | Two years |
| Acceptance records | For the duration of the service and then six years, because they are the record of what was agreed |
| Invoices and tax records | For the period required by UAE tax law |
| Connected account credentials | Deleted on termination or within [PLACEHOLDER: number] days of your written request |
You can ask us to delete your data at any time by emailing info@luxoasisadvisory.com. Where we must keep something for a legal reason, we will tell you what and why.
09Your rights
You have the right to ask us to give you access to your personal data, correct it, erase it, restrict how we process it, provide it in a portable form, and to object to processing based on legitimate interests. You can also withdraw consent where we rely on it.
We respond within 30 days. If a request is complex we will tell you and give a new date. We do not charge for this.
If you are unhappy with how we have handled your data you can complain to us first, and then to the competent supervisory authority in your jurisdiction.
10Security
Data is held on encrypted cloud infrastructure with authenticated access, and access inside our team is limited to the people who need it to do the work. We apply appropriate technical and organisational measures. We do not hold any security certification and we do not claim to meet any named security standard. No system can offer an absolute guarantee of security.
If a breach affects your personal data, we will tell you without undue delay and describe what happened, what data was involved and what we are doing about it.
11Cookies and the website
Our website sets no cookies, runs no analytics and stores nothing in your browser. It does load web fonts from Google and, on some pages, a partner badge image from a third-party directory, both of which disclose your IP address to those providers. The Cookie Policy explains this in full.
12Changes to this policy
If we make a material change we will tell active clients by email at least 30 days before it takes effect, and we will archive the previous version at its permanent URL. Every version carries a version number and an effective date.
13Contact
Lux Oasis Advisory & Services LLC, Sharjah Free Zone (SHAMS), United Arab Emirates. Licence number 2645909. TRN 104722180700003.
Email: info@luxoasisadvisory.com · WhatsApp: +971 58 508 9283
This document has been prepared for review and requires sign-off by a qualified UAE lawyer before publication. It is not legal advice.