Privacy Policy

Last updated: 28 September 2026

At Dopa, we are committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, share and protect your data when you use any of our services: our online platform to book tours and activities in Jordan and across the region at dopatravel.com, the Dopa mobile app, the online shops and storefront websites that Dopa runs for Hosts, Dopa Business at business.dopatravel.com (the dashboard that tour and activity providers use), and the WhatsApp messages we send and receive (together, the "Services").

Please read this policy to understand how we handle your personal data when you use the Services.

1. Who We Are

The Services are provided by DOPA SOLUTIONS - FZCO ("Dopa", "we", "us"), a free zone company licensed by the Dubai Integrated Economic Zones Authority (DIEZ) under licence No. 7081, with its registered office at DSO-THUB-G-D-FLEX-G111, THUB, Dubai Silicon Oasis, Dubai, United Arab Emirates.

Dopa is a booking platform. Tours, activities, experiences and products are provided by independent businesses ("Hosts"). For the personal data described in this policy, Dopa decides how and why it is used (we are the "data controller"), with one exception: when a Host connects its own WhatsApp Business number to Dopa Business, the Host is the controller of that WhatsApp data and Dopa processes it on the Host's behalf (see section 5).

For any privacy question or request, email info@dopasolutions.com.

2. What Information We Collect

When you use the Services, we may collect:

Personal Information: your name, email address, phone number (which we also use to reach you on WhatsApp), and payment details. If you sign in with a third-party account, we receive your name and email address from that account's provider. Card payments are processed by licensed payment service providers; we do not store your full card number.
Booking and Order Details: selected tours and activities, travel dates, number of guests, preferences, and transaction history, and, for orders in a Host's online shop, your delivery address.
Booking Documents: forms a Host asks you to complete for a booking, such as participant details or a waiver, and what you enter or sign in them.
Technical Information: your IP address, browser type, operating system, device identifiers, and interactions with our website and apps. We also collect information about how you interact with our emails, such as whether they are opened and their links clicked, and the approximate location we estimate from your IP address.
Location Data: in our mobile app, with your permission, your device's location, which we use to show you experiences nearby.
Messages: WhatsApp messages you exchange with Dopa, or with a Host through Dopa Business, including your WhatsApp profile name, attachments and delivery status (see sections 4 and 5).

If you are a Host or a member of a Host's team, we also collect your business and contact details, your team members' names, email addresses and phone numbers, your activities, products, prices, bookings and settlement records, and, if you connect your WhatsApp Business number, the data described in section 5.

3. How We Use Your Information

We collect your information to deliver a smooth and secure travel booking experience. This includes:

Processing your bookings, orders and payments.
Sending booking confirmations, updates and cancellation notices by email, push notification and WhatsApp.
Sending account and security messages.
Offering customer support, including over WhatsApp.
Providing Dopa Business to Hosts, including the WhatsApp features described in sections 4 and 5.
Improving our website, apps, services, and user experience.
Providing personalized travel recommendations, such as experiences near you.
Sending promotional emails, which you can unsubscribe from at any time, and measuring whether our emails are opened and their links clicked.
Keeping the Services secure, preventing fraud, and meeting our legal obligations.

4. WhatsApp Messages on Dopa's Own Number

We use the WhatsApp Business Platform, provided by WhatsApp and Meta Platforms ("Meta"), to message customers and Hosts from Dopa's own WhatsApp number.

What we send: service messages about your bookings and orders, such as confirmations, receipts, payment requests, booking documents and cancellation notices; account and security messages; and replies to messages you send us.
What we receive and keep: your WhatsApp number and profile name, the messages and attachments (such as photos, documents and voice notes) you send to our number, and whether our messages were delivered and read.
Who can see it: authorised members of our team and, in its conversation with you, a Host that is in contact with you through our number, such as the Host of your booking.
Assistant for Hosts: when a Host uses Dopa's assistant, the messages the Host sends to it are processed with the help of a third-party AI service provider to help the Host with Dopa Business. Messages from customers are not sent to the assistant.
Opting out: we do not send marketing campaigns from our own WhatsApp number. To stop promotional WhatsApp messages from a business that uses Dopa Business, reply STOP to it, and reply START to receive them again. Service messages about a booking or order you made, such as confirmations, payment links and cancellations, are still sent because they are needed to deliver it.

5. Hosts Who Connect Their WhatsApp Business Number

When a Host connects the phone number it already uses with the WhatsApp Business app to Dopa Business through Meta's Embedded Signup, the Host keeps using the WhatsApp Business app on its phone, and Dopa Business sends and receives messages on the same number through Meta's WhatsApp Cloud API (Meta calls this "coexistence"). For this data, the Host is the controller and Dopa is the Host's processor (service provider). We use the data only to provide Dopa Business to that Host and only on its instructions. We do not sell it, we do not use it to market our own services to the Host's customers, and we do not share it with other Hosts.

What data flows through Dopa Business

Account details from Meta: identifiers and status information for the Host's WhatsApp Business account and phone number, such as its display name and quality rating, and the permission, granted by the Host through Meta, for Dopa Business to send and receive messages on the Host's behalf. We never receive the Host's Facebook password.
Contacts: the contacts saved in the Host's WhatsApp Business app (names and WhatsApp numbers), which Meta shares automatically right after the Host connects, and later additions and changes. Imported contacts are not treated as having agreed to receive marketing.
Chat history: only if the Host taps Confirm in the WhatsApp Business app to share it, the Host's one-to-one chats from up to the last 6 months before connecting. Photos and files are included only from the last 14 days. Group chats are not imported.
Ongoing messages: messages the Host's customers send to the number, messages the Host sends from Dopa Business, and copies of messages the Host sends from the WhatsApp Business app, so both apps show the same conversation.
Delivery information: whether each message was sent, delivered, read or failed, and the customer's WhatsApp profile name and number.
Templates: the message templates on the Host's account, including the booking templates Dopa creates for the Host, and Meta's approval, quality and category updates for them.

Why we use it: to send the Host's booking confirmations, payment links and cancellation notices from the Host's own number; to show the Host one inbox of its WhatsApp conversations and let it reply; to respect customers' opt-outs; to show the health of the connection; and for support, troubleshooting and security. Access by Dopa personnel is limited to what is needed to provide support and keep the Services secure.

Meta's role: WhatsApp messages are carried by Meta's WhatsApp Business Platform. Meta processes message content and metadata under its own terms and privacy policy. Meta bills the Host directly for the messages Dopa Business sends from the Host's number.

The Host's responsibilities: the Host must have a lawful reason to message its customers (for example, the customer booked with the Host or agreed to receive WhatsApp messages), must give its customers the privacy information the law requires, and must follow WhatsApp's business and commerce policies.

Disconnecting: a Host can disconnect at any time, in Dopa Business (WhatsApp, then Disconnect) or in the WhatsApp Business app (Settings, then Account, then Business Platform). When a Host disconnects, we stop sending and receiving messages for that number and end our access to it, and booking messages to the Host's customers may be sent from Dopa's own number instead. To end the connection at Meta as well, the Host should also disconnect in the WhatsApp Business app. Conversations, contacts and imported chat history already in Dopa Business stay in the Host's account, so the Host keeps its records, until the Host asks us to delete them (see section 11).

If you are a Host's customer: the Host decides how your messages are used. Contact the Host to access or delete them. You can also write to us at info@dopasolutions.com, and we will pass your request to the Host and help it respond.

6. Sharing Your Data

Your privacy is important to us. We do not sell or rent your data. We share it only with:

Hosts: the Host that provides your booking or order receives the booking and contact details it needs to deliver it, and the documents you complete for it, and can read WhatsApp messages as described in sections 4 and 5. The Host uses these details under its own responsibility, as a separate controller, to deliver your booking, and is responsible for handling them lawfully.
Meta Platforms (WhatsApp and Facebook): to deliver WhatsApp messages (sections 4 and 5). Our mobile app also uses Facebook App Events, which sends Meta information about how the app is used, such as screens viewed, reviews, bookings and cancellations, together with an identifier for your account. Meta may use this information to provide measurement services and to target and deliver ads. You can limit this through your device's advertising settings and your ad preferences on Facebook or Instagram.
Service providers that run our Services: companies that host, store, deliver and secure our websites, apps and data, provide our company email, and deliver our emails and push notifications. If you would like to know which service providers process your data, contact us at info@dopasolutions.com.
A third-party AI service provider: for the assistant for Hosts (section 4).
Analytics and location providers, including Google (Google Analytics on our website and Firebase Analytics in our apps): to understand how the Services are used, fix problems and estimate your approximate location from your IP address. We also use Google Maps to show locations.
Licensed payment service providers: process your card and bank payments.
Regulatory authorities, if required by law or to protect the rights and safety of our users and platform.

We share with each provider only the data it needs to provide its service to us, and we require the providers we share it with to give it the same or equal protection as this policy describes.

7. International Transfers

Dopa is based in the United Arab Emirates and serves travellers and Hosts in Jordan and across the region. Our service providers may process data outside your country, including in the European Union and the United States. When your data leaves your country, we rely on these providers' contractual and security commitments to protect it.

8. How We Protect Your Data

We use industry-standard security measures to protect your personal data from unauthorized access, misuse, or loss. This includes:

Encryption of data in transit (TLS)
Secure payment gateways
Access controls and firewalls
Limiting access to personal data to people who need it

While we do our best, no online system is completely secure. Please take care when sharing sensitive information.

9. How Long We Keep Your Data

Account data: while your account is open, and after you close it until you ask us to erase it (section 11).
Booking and payment records: for as long as tax, accounting and anti-fraud laws require.
WhatsApp conversations, contacts and attachments: kept so that Dopa and Hosts have a record of their conversations with customers, until deletion is requested (section 11).
Technical records: kept only as long as needed for the purposes described in this policy, such as operating, troubleshooting and securing the Services.
Backups: kept securely so that we can recover from incidents, and used only for that purpose.

10. Your Rights and Choices

You have full control over your personal data:

Access or update your information at any time.
Request to delete your account or personal data.
Object to or ask us to restrict certain uses of your data, and withdraw any consent you gave.
Receive a copy of your data in a common format, where the law gives you that right.
Unsubscribe from promotional communications via the unsubscribe link, by replying STOP on WhatsApp, or by contacting us.
Complain to your local data protection authority.

To make a request, please email: info@dopasolutions.com. We may ask you to confirm your identity, and we reply within 30 days.

11. How to Delete Your Data

Customers: in the Dopa app, open the Account tab and tap Delete Account to close your account. If you cannot do this in the app, or you also want the personal data in your account erased, email info@dopasolutions.com from the email address linked to your account, or tell us how else to identify it. We will verify your identity before acting on your request. Step-by-step instructions are at dopatravel.com/en/delete-account.
Hosts: to delete your Dopa Business account, or the WhatsApp data in it (conversations, contacts and imported chat history), email info@dopasolutions.com from your account's email address and say what you want deleted. We will verify your identity before acting on your request. If your WhatsApp Business number is connected, disconnect it first (section 5).
People who messaged a Host: contact the Host, or email info@dopasolutions.com and we will help the Host respond.

We complete deletion requests within 30 days. We may keep records the law requires us to keep, such as booking and payment records, and a record of your opt-out so that you are not messaged again after asking to stop. Copies may remain in our backups, which we use only to recover from incidents. Deleting data from Dopa does not delete it from WhatsApp on your phone or from Meta; WhatsApp's own privacy policy explains how to manage that data.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to:

Keep you signed in and remember your preferences.
Improve site performance, speed and security.
Know whether our emails are opened and their links clicked.
Understand how visitors use our website, through Google Analytics, so we can improve it.

Our mobile app uses Firebase Analytics and Facebook App Events for similar purposes (section 6). Meta may also use Facebook App Events information for measurement and advertising, and section 6 explains how you can limit this. You can manage your cookie preferences through your browser settings at any time.

13. Children's Privacy

Our platform is not intended for users under the age of 13. We do not knowingly collect data from children. If you believe a minor has shared data with us, please contact us for prompt removal.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect updates in technology, law, or our services. The latest version will always be posted on this page, and the date at the top shows when it was last updated.

15. Contact Us

DOPA SOLUTIONS - FZCO
DSO-THUB-G-D-FLEX-G111, THUB, Dubai Silicon Oasis, Dubai, United Arab Emirates
Licensed by the Dubai Integrated Economic Zones Authority (DIEZ) under licence No. 7081
Privacy requests: info@dopasolutions.com
Customer support: support@dopatravelapp.com
Security reports: to report a security vulnerability in our websites or apps, email info@dopasolutions.com with "Security report" in the subject line.
Phone: +971 585 658 070