Privacy Policy
Effective date: 28 October 2026.
1. Who is responsible
ERG Motorsport company, trading as ERG / Extreme Riders, operates the ERG customer app and Workshop OS. Dubai Economic Department trade licence: 1572983. Registered business address: Ras Al Khor Ind. Second - Ras Al Khor Industrial Area 2 - Dubai.
Contact us about privacy or your account at extremeridersdxbbooking@gmail.com or +971 50 2047 549. This policy covers our customer app, workshop records and communications. Website-specific cookies and external services must be disclosed in the website's cookie notice where applicable.
2. Information we use
We process account names, email addresses, phone numbers and authentication identifiers; motorcycle details and usage readings; requests, preferences, addresses and event locations supplied by you; job cards, estimates, approvals, service records, invoices, payment status, loyalty activity and support correspondence. We also process files or design references you choose to provide through supported channels. Please do not submit unrelated personal information, passwords or full payment-card details in request notes.
Our authentication provider handles password credentials. Authorized workshop staff do not need your password. Optional notifications use a device notification token linked to your account. Hosting and security services may process connection information, including IP addresses, timestamps and error logs. The current app does not require continuous GPS tracking, microphone recording or advertising tracking. Adding a pickup address is not permission to monitor your movements.
3. Purposes and grounds
We use necessary information to establish and administer your account, respond to your requests, inspect and maintain motorcycles, arrange transport and storage, provide lessons and race support, prepare graphics and parts orders, record your approvals and payments, and administer rewards. Processing also supports security, dispute handling and applicable legal and accounting obligations.
Where applicable law permits processing necessary to enter into or perform a contract, meet a legal obligation or establish or defend a legal claim, we rely on that permission. Where consent is required, we seek it separately and allow withdrawal without affecting processing already lawfully undertaken. Accepting our terms is not blanket consent to unrelated marketing or optional tracking. Withholding information necessary to perform a service may prevent that service.
4. Access, providers and communications
Authorized ERG staff receive access appropriate to their duties. We share relevant information with service providers or contractors only as needed for the requested service, administration, security or legal obligations.
- Supabase supports authentication, database, private file storage and backend services.
- Resend supports operational emails where configured. Authentication emails are sent through Supabase Auth using the configured Hostinger SMTP mailbox.
- Expo, Apple APNs and Google FCM support optional mobile notifications where enabled. You can control notification permission in your device settings.
- Apple and Google distribute the mobile app.
- Choosing WhatsApp can pass prefilled request information into WhatsApp. You must press Send to transmit the message to ERG. WhatsApp's own privacy terms apply; ERG does not use an automated WhatsApp booking bot in this release.
An app request is saved independently of whether you send a WhatsApp message. Service notifications are not advertising consent. We do not sell your personal data. We may make necessary disclosures to competent authorities where lawfully required. Paid digital video subscriptions and external Google/Microsoft calendar synchronization are not part of the current launch workflow.
5. Storage, transfers and safeguards
Records may be held in ERG's protected local workshop database and controlled Excel exports, and in Supabase and other relevant provider systems. This is not a cloud-only system. Service providers may process information outside the UAE. ERG must assess and apply the transfer conditions and safeguards required by the law applicable to it; contact us for information about relevant processing locations and safeguards.
We apply access controls, protected authentication, encrypted network connections and restricted backend operations. Managed workshop backups are encrypted. No system is completely risk-free. Please protect your device, use a unique password and notify us promptly of suspected account misuse.
6. Retention
We retain information for the purpose for which it is needed, not indefinitely merely because storage is available. Account and operational records remain while needed for active services and are reviewed when you request deletion. Necessary accounting records may remain in a restricted archive for seven years after the relevant tax period where UAE corporate-tax rules apply, or longer where another applicable requirement, audit or legal hold requires it. This is not a seven-year retention rule for every piece of account data.
Records necessary for motorcycle custody, safety incidents, warranty claims or disputes are restricted and retained only for the relevant obligation or claim. ERG's managed local recovery-backup policy uses a 30-day rolling window, with expiry processed when the backup system runs, except for documented holds. Provider backups and separately exported copies must be handled through their applicable controls; account deletion is not a promise that every historical copy disappears immediately. Restored records must be reconciled with deletion records before normal use.
7. Your choices and rights
Subject to applicable law, you may request access, correction, deletion, a copy or transfer of your data, and restriction of or objection to particular processing, and withdraw consent where consent is the basis. Contact our privacy email. We may request proportionate identity verification but will not ask for your password. If we cannot comply fully, we will explain the reason and any applicable route to challenge our response or complain to the competent authority.
Account deletion is available in Profile settings and at our Account Deletion page. ERG targets a response and completion of eligible deletion within 30 days, explaining any lawful delay. This is ERG's operating target, not a statement of a universal statutory deadline. Unpaid amounts do not justify retaining all unnecessary personal data or keeping login access active.
8. Young riders and policy changes
Young riders may participate only through arrangements approved with a parent or legal guardian and the relevant coach or organizer. An adult must arrange the contract and any required consent. Contact us if a child has submitted personal information without the required authorization. We do not use children's information for targeted advertising.
We will publish updated versions when our practices change and provide additional notice or obtain consent where required. New purposes are not retrospectively authorized by an old account acceptance.