Privacy Policy 

Last updated: [14th Sep 2026] · Data Controller: Dubai Racing Club, Meydan Racecourse, Dubai, United Arab Emirates · Contact: racing@dubairacingclub.com

1. Introduction

This Privacy Policy explains how the Dubai Racing Club (“DRC”, “we”, “us”) collects, uses, stores and protects your personal information when you use the DRC Experience mobile application (the “App”). The App is provided to invited guests of the Dubai Racing Club to register their invitation, receive a digital guest pass, and access DRC events at Meydan Racecourse. By using the App, you agree to the practices described in this policy.

2. Information We Collect

We collect only the information needed to verify your identity, issue your guest pass and manage your access to DRC events.

2.1 Information you provide or that is provided by your inviter

•     Identity and contact details — your name, mobile number and email address, as held on the official DRC guest list or entered during registration.

•     Guest-of-Guest details — if an Official Guest invites you, the name, mobile number and email address used to send your invitation.

2.2 Information collected when you sign in

•     UAE PASS verification — if you sign in with UAE PASS, we receive verified identity information from UAE PASS (such as your name, Emirates ID reference, mobile number and email, subject to your consent in UAE PASS) to confirm you are on the official guest list.

•     One-time password (OTP) — if you sign in with your mobile number, we send and verify a one-time password by SMS.

2.3 Live photo (facial liveness)

During registration, the App asks you to take a live photo of yourself. This photo is captured using Microsoft Azure Face liveness detection, which performs a challenge-response check to confirm that a real, live person is present at the camera (rather than a photo or video of someone else). The check is used to prevent fraudulent registration. The resulting photo becomes the photo on your digital guest pass and is shown to DRC staff for visual verification at the gate.

2.4 Information collected automatically

•     Pass and entry data — your badge identifier, pass type, the events your pass covers, and a record of your entries (date, time and gate) when your pass is validated.

•     Device and technical data — device type, operating system version and app version, and basic diagnostic/crash information used to keep the App working reliably.

3. How We Use Your Information

We use your information to:

•     Verify that you are an invited guest and confirm your identity;

•     Issue, display and manage your personal digital guest pass;

•     Enable entry to DRC events by validating your pass at the gate;

•     Allow Official Guests to invite their own guests within their allowance and track invitation status;

•     Show you the events your pass covers and send event reminders and important updates;

•     Prevent fraud, badge sharing and unauthorised access;

•     Maintain the security, reliability and performance of the App and the underlying service.

We do not use your live photo for any automated facial-recognition matching. The photo is used only as a visual reference for DRC staff and as the image on your pass. We do not sell your personal information.

4. Legal Basis and Consent

We process your information to perform the guest-access service you have been invited to use, to meet our legitimate interests in securing our events, and on the basis of your consent — including the consent you grant within UAE PASS and the consent to capture your live photo during registration. You may withdraw consent by discontinuing use of the App and contacting DRC Guest Services, subject to the effect this has on issuing or maintaining your guest pass.

5. How We Share Your Information

We share personal information only as necessary to operate the guest-access service:

•     DRC teams — authorised Guest Services, security and operations staff who manage guests and validate entry;

•     Service providers — UAE PASS (identity verification), the SMS provider (OTP and notifications), Microsoft Azure (facial liveness detection and secure cloud hosting), and Apple Wallet / Google Wallet (to add your pass to your device wallet), each acting under agreement and only for the purposes described here;

•     SMS service provider — to send one-time passwords (OTP), invitations and event notifications by SMS, we share your mobile number and the message content with our third-party SMS gateway provider solely to deliver these messages. The provider acts on our behalf under agreement, does not use your number for its own marketing, and returns delivery status to us so we can manage retries;

•     Email service provider — when invitations, confirmations and notifications are delivered by email, we share the recipient’s name and email address with our third-party email delivery provider solely to send those messages. The provider processes this data on our behalf under agreement, does not use it for its own purposes, and returns delivery status (for example delivered, bounced or failed) to us;

•     Legal and safety — where required by law, regulation or a lawful request, or to protect the safety and security of guests, staff and the venue.

We do not share your information with third parties for their own marketing.

6. Data Storage, Location and Security

Your information is stored on secure cloud infrastructure and hosted in UAE-approved regions in line with applicable UAE data-protection requirements. We protect your information with encryption in transit and at rest, access controls limiting access to authorised personnel, and continuous monitoring. Guest passes are validated server-side and can be revoked instantly.

7. Data Retention

We keep your information for as long as needed to provide the guest-access service and to meet legal, security and reporting obligations — for the duration of the event season and a retention period thereafter. After this period, personal information is deleted or anonymised in line with DRC’s data-retention policy.

8. Your Rights

Subject to applicable UAE law, you may request access to the personal information we hold about you, ask us to correct inaccurate information, or request deletion of your information. To exercise these rights, contact DRC Guest Services at racing@dubairacingclub.com. We will respond within a reasonable period.

9. Children’s Privacy

The App is intended for adult invited guests and is not directed at children. We do not knowingly collect personal information from children without appropriate consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available at the policy URL, with the “Last updated” date revised accordingly. Significant changes will be communicated through the App where appropriate.