Privacy Policy

Last updated: 26 June 2025 · Applies to thundermobility.om and related booking services

1. Who we are

Thunder Mobility ("Thunder", "we", "us") operates a car-rental marketplace in the Sultanate of Oman. We connect travellers with independent rental operators.

Contact: privacy@thundermobility.om

2. Data controllers

Before you submit a booking request, Thunder Mobility is the data controller for information you provide on this website (name, phone, email, dates, and preferences).

After your request is transferred to the rental operator you selected, that operator becomes an independent data controller for your personal data. They verify identity and driving credentials at the counter and manage the rental contract, deposit, and payment directly with you. Thunder does not control how operators process data once the handoff occurs.

3. What we collect

When you submit a booking request, we collect:

Full name, phone number, and email address
Pickup and return dates and times
Selected car and operator
Advisory quote snapshot (for your reference and operator handoff)
Locale, referrer, landing page, and UTM parameters (for service improvement)
Timestamp of your privacy consent

We do not collect national ID numbers, passport numbers, or driver-licence details through this website. Operators verify these documents in person at pickup.

4. How we use your data

Process and forward your booking request to the selected operator
Send you a booking receipt and status updates by email
Notify the operator of your request
Improve our marketplace and prevent abuse
Comply with applicable law

We do not sell your personal data to third parties. We do not take payment on this website — payment is handled directly with the operator at the counter.

5. Legal basis (PDPL)

We process your data based on your consent (given at booking submit) and our legitimate interest in operating the marketplace and facilitating the handoff to your chosen operator.

6. Data sharing

We share your booking details with:

The rental operator you selected (primary recipient)
Our email delivery provider (Resend) to send transactional messages
Our hosting and infrastructure providers (Cloudflare) as data processors

7. Data residency and retention

Booking data is stored in Supabase (PostgreSQL) with servers in regions selected for our deployment. We retain booking records for up to 24 months after the rental period ends, or longer if required by law or an open dispute. You may request earlier deletion subject to legal obligations.

8. Your rights

Under Oman's PDPL, you may:

Access the personal data we hold about you
Request correction of inaccurate data
Withdraw consent (this may prevent us from processing future requests)
Request deletion, subject to legal retention requirements
Lodge a complaint with the Ministry of Transport, Communications and Information Technology (MTCIT)

To exercise your rights, email privacy@thundermobility.om. For data held by a rental operator after handoff, contact that operator directly.

9. Cookies and analytics

We use essential cookies for site functionality. We do not use third-party advertising trackers. If we add analytics in future, this policy will be updated and consent will be requested where required.

10. Security

We use HTTPS, server-side data access, and access controls to protect your information. No method of transmission over the internet is 100% secure; we work to maintain reasonable safeguards appropriate to the data we hold.

11. Changes

We may update this policy from time to time. Material changes will be posted on this page with an updated date. Continued use after changes constitutes acceptance of the revised policy.