1. Who we are

Renommé is a managed reputation-operations service operated by a Dubai mainland company licensed by the Dubai Department of Economy and Tourism (DET/DED). For privacy enquiries, contact us at hello@renomme.co.

This notice describes Renommé's own data processing. Where Renommé acts on documented instructions from a client business, that client business remains responsible for its own privacy notices and for the processing it has instructed us to perform on its behalf.

2. Information we may process

Depending on how you interact with us, we may process:

• Public Google review information — displayed reviewer name, review text, rating and timestamps — in connection with client-authorised locations;
• Public Google Business Profile and location information;
• Response drafts, edits, approvals, publication status and audit records;
• Client Voicebook, authorised approver details and business contact information;
• Website enquiry and contract-administration information;
• Security, access and support logs necessary to protect the service.

We do not request or store passport numbers, Emirates ID, payment-card details, health records, room or booking details, or private complaint files through our standard review-operations workflow.

3. Sources

Information may come from public Google Business Profiles, client instructions and authorised platform access, client staff and named approvers, direct enquiries to Renommé, and our own service and security systems.

4. Purposes and legal basis

We process information to:

• Provide contracted review monitoring, drafting, approval and reporting services;
• Administer client and commercial agreements;
• Maintain security and investigate incidents;
• Comply with applicable law;
• Respond to enquiries.

The applicable legal basis or UAE Personal Data Protection Law (PDPL) exception for each purpose is identified in our internal data-processing register and client Data Processing Addendum. We do not rely on an unevidenced general basis for any purpose.

Promotional outreach, review-request campaigns, private guest recovery, benchmarking and AI-model training are separate purposes and are not covered simply because review operations are contracted.

5. AI-assisted operations — disclosure

A substantial part of Renommé's operational workflow — including review classification, risk assessment and response drafting — is performed by an autonomous AI agent. Every response draft is subject to review and explicit approval by a named human approver before publication. We do not publish content autonomously or without human sign-off.

Client data is not used to train general-purpose AI models. Third-party model providers are contractually required to disable training on client data where that option is available and verifiable.

6. Public replies

Approved replies are intentionally published on Google and may be seen, copied or retained by the public and by Google. Published replies will not reveal private booking details, health information, identity documents, payment information or private complaint records.

7. Sharing and service providers

(1/2)

We may use approved service providers for Google Business Profile access, secure hosting, security operations, AI-assisted drafting and translation, approval notifications and reporting. We do not sell personal data to any third party.

Our service-provider register — listing provider names, functions, data categories and countries of processing — is maintained internally and made available to clients under our Data Processing Addendum before any live processing begins.

8. International transfers

Some service providers may process information outside the UAE. Where this occurs, Renommé documents the applicable transfer mechanism and safeguards under UAE law before processing begins. We will not represent that all data remains in the UAE unless that has been verified across all providers, backups and support access.

9. How long we keep information

We retain information only for documented service, security, legal and objection-handling purposes. Specific retention periods for live workflow data, approval evidence, operational reports, security logs, backups and marketing-suppression records are set out in our client Data Processing Addendum. OAuth access tokens are revoked when no longer required or at termination of a client relationship.

10. Security

We apply proportionate technical and organisational controls including named-account access, least-privilege authorisation, multi-factor authentication for privileged access, encrypted storage for OAuth tokens and secrets, tenant and location scoping, audit logging and incident-response procedures. No transmission or storage method is entirely free of risk.

11. Your rights

Subject to applicable UAE law and identity verification, individuals may have rights to access, correct, delete or restrict the processing of their information, or to object to it. Requests relating to information processed on behalf of a client venue may be referred to that client as the responsible party. To make a request or enquiry, contact us at hello@renomme.co.

12. Marketing and direct contact

Operational approval messages sent to named client contacts are kept separate from marketing communications. Renommé does not conduct unsolicited telephone, SMS or WhatsApp outreach under this notice. Where marketing activity is separately authorised, documented permissions, opt-out controls and applicable channel rules will apply.

13. Changes to this notice

Material changes will be dated and communicated as appropriate. The current version of this notice is always available at renomme.co/pages/privacy-notice.

14. Contact and complaints

For privacy questions or concerns, contact hello@renomme.co. If you remain unsatisfied, you may contact the competent UAE data-protection authority.