This Privacy Policy explains how and why the real-estate platform (“the Platform”, “we”, “our”, “us”) collects, uses, shares, stores, and protects personal data when you browse, create an account, post or view property listings, communicate with other users, or otherwise interact with any of our websites, mobile applications, application-programming interfaces (APIs) or related services (collectively, the “Services”).
It applies to all visitors, registered users, brokers, developers, landlords, tenants, and any other natural persons whose personal data we process, irrespective of their location.
By accessing or using the Services, you acknowledge that you have read and understood this Policy and agree to the practices it describes.
“Personal Data” means any information relating to an identified or identifiable natural person, as defined in Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”).
“Processing” includes any operation performed on Personal Data such as collection, recording, storage, alteration, retrieval, disclosure, transfer, or erasure.
“Data Subject” refers to the individual to whom the Personal Data relates.
“Controller” is the party that determines the purposes and means of Processing Personal Data.
“Processor” is a party that processes Personal Data on behalf of the Controller.
“Services” has the meaning given in Section 1.
“Applicable Law” means the PDPL, its Implementing Regulations, Cabinet Decision No. (10) of 2019 (AML), DLD and RERA rules, and any other UAE legislation or regulatory guidance relevant to data protection and real-estate activities.
For the majority of data collected through the Platform—including account information, usage logs, and marketing preferences—the Platform operator acts as the Data Controller.
When a licensed broker or developer uploads client details or property information, the broker or developer remains the Data Controller for that content, and the Platform acts as a Data Processor, processing such data strictly on documented instructions.
We may process the following categories of Personal Data (depending on your interactions with the Services):
Identity Data – name, nationality, Emirates ID or passport details, date of birth, gender, photograph, signature.
Contact Data – residential and correspondence address, e-mail address, telephone number, preferred language.
Account Credentials – username, hashed password, authentication tokens, security-question answers.
Professional & Licensing Data – RERA broker licence number, Trakheesi permit, trade licence copies, corporate authorisations.
Property Data – property location, size, photographs, floor plans, tenancy details.
Financial & Transaction Data – bank account details, payment-card partial numbers, escrow information, invoices, tax records.
KYC / AML Data – source-of-funds declarations, sanctions-screening results, politically exposed person (PEP) status, adverse-media findings.
Usage & Technical Data – IP address, device type, browser version, operating system, referral URL, clickstream, pages viewed, session timestamps.
Marketing Preferences – opt-in or opt-out choices for newsletters, alerts, and promotional messages.
We do not intentionally collect special-category data such as health information or biometric templates unless required by law (e.g., facial-liveness checks for identity verification) and only with your explicit consent.
Direct interactions: data you provide by filling in forms, creating an account, uploading a listing, participating in live chat, or contacting customer support.
Automated technologies: data collected automatically through cookies, server logs, and similar tools when you interact with the Services.
Third parties:
Licensed brokers or developers supplying listing feeds or CRM integrations;
Payment processors and banks confirming transaction status;
Government and regulatory databases (e.g., DLD, RERA, UAE Pass);
Sanctions and compliance screening providers;
Publicly available sources such as land registries and social-media platforms, where permitted by law.
We rely on one or more of the following lawful grounds:
Contractual necessity – Processing required to perform or enter into a contract with you (e.g., creating your user account, facilitating a reservation deposit).
Legal obligation – Processing necessary to comply with UAE laws, regulations, or court orders (e.g., AML/CTF reporting, record-keeping duties).
Legitimate interests – Processing to pursue our legitimate business interests, provided that your fundamental rights do not override those interests (e.g., fraud prevention, network security, service analytics).
Consent – Processing based on your explicit, freely given consent for a specific purpose (e.g., direct marketing, non-essential cookies, biometric verification). You may withdraw consent at any time without affecting the lawfulness of Processing carried out before withdrawal.
Vital interests – Processing required to protect someone’s life or physical integrity (rare, emergency-only basis).
Public interest – Processing necessary for matters of substantial public interest, as defined by the PDPL or other UAE statutes (e.g., public-health directives).
Account registration, authentication, and management;
Publishing, promoting, and updating property listings;
Facilitating enquiries, viewings, offers, reservations, and other transactional steps;
Conducting KYC, AML, and sanctions screening to satisfy regulatory obligations;
Processing payments, escrow deposits, refunds, and invoice management;
Providing customer support, dispute resolution, and technical assistance;
Improving, testing, and securing the Services, including debugging and usage analytics;
Sending service announcements, system alerts, and administrative messages;
Delivering marketing communications where you have opted in;
Complying with legal requests, governmental audits, investigations, and court orders;
Enforcing our Terms & Conditions and protecting our rights, property, and users.
To comply with Federal Decree-Law No. 20 of 2018 (AML) and Cabinet Decision No. (10) of 2019, we conduct risk-based due-diligence on customers and transactions. This includes:
Verifying identity and beneficial ownership using government-issued documents and biometric checks;
Collecting proof of address, proof of funds, and source-of-wealth information where required;
Screening parties against UAE, UN, EU, UK, and OFAC sanctions lists, PEP databases, and adverse-media feeds;
Monitoring thresholds (e.g., cash or virtual-asset transactions equal to or exceeding AED 55,000) and reporting suspicious or unusual activity to the UAE Financial Intelligence Unit via “goAML”;
Retaining KYC/AML records for a minimum of five years after the end of the business relationship or completion of the transaction, in accordance with AML legislation and PDPL retention principles;
Restricting access to KYC data to authorised personnel on a strict “need-to-know” basis and securing the data with encryption, audit trails, and dual-control safeguards.
We do not seek to collect or process “special categories” of Personal Data—such as health information, genetic data, religious beliefs, or biometric identifiers—unless strictly required by law or essential to the Services you request.
Biometric verification. If we ask you to complete a facial-liveness or ID-match check, we process the resulting biometric template solely to confirm your identity and prevent fraud, on the basis of your explicit, prior consent.
Children’s data. The Platform is not directed at persons under 18 years old; we do not knowingly collect their data.
Where we must handle special-category data, we apply enhanced technical and organisational safeguards (encryption at rest, role-based access, shortened retention) and ensure there is a lawful basis under PDPL Articles 5–7 as well as your explicit consent where required.
Cookies, web beacons, SDKs, and local-storage objects help us recognise your browser, improve performance, and deliver personalised content.
Strictly necessary cookies enable core features such as secure log-in and fraud detection; they are set automatically and cannot be disabled.
Analytics cookies collect aggregated statistics (page views, dwell time) to help us optimise the Platform. They are deployed only after you grant consent via the banner.
Advertising cookies are placed by approved networks to show you targeted real-estate ads; they operate only with your opt-in consent.
You can withdraw or modify consent at any time through the cookie-settings panel or by adjusting your browser settings. Blocking cookies may affect site functionality.
We use limited automated logic to:
Detect suspicious activity (e.g., unusually high listing volume from one IP address);
Prioritise search results based on your location, saved filters, and past interactions;
Screen transactions against sanctions and PEP lists.
These processes do not produce legal or similarly significant effects on you without human intervention. You have the right to request human review of any decision that materially affects you, to express your viewpoint, and to contest the outcome.
We share Personal Data only in the circumstances below and under strict confidentiality obligations:
Service providers – hosting companies, payment processors, KYC vendors, analytics platforms, and customer-support tools that process data on our instructions;
Licensed brokers, developers, and landlords – when you submit an enquiry, schedule a viewing, or make an offer;
Banks and escrow agents – to administer reservation deposits and other client monies;
Regulators, law-enforcement, and courts – where disclosure is mandated by the PDPL, AML legislation, or a lawful order;
Successors in title – if we undergo a merger, acquisition, or asset sale, provided the recipient honours this Policy.
We never sell or rent your Personal Data to third parties for their own marketing purposes.
The Platform’s primary servers are located in the UAE. Where it becomes necessary to transfer Personal Data outside the UAE (for example, to a cloud provider or support centre), we ensure an adequate level of protection by:
Transferring to a jurisdiction formally recognised as “adequate” by the UAE Data Office; or
Executing UAE-approved Standard Contractual Clauses with the overseas recipient; or
Relying on another PDPL-permitted derogation (e.g., your explicit consent, contract performance, or the establishment, exercise, or defence of legal claims).
Copies of applicable safeguards are available on request.
We retain Personal Data no longer than necessary for the purposes set out in this Policy:
KYC/AML records – minimum five (5) years after the business relationship ends or the transaction completes, per AML regulations;
Account data – for as long as your account is active and up to two (2) years after deletion to resolve disputes or comply with legal obligations;
Marketing preferences – until you withdraw consent;
Cookies – expiry ranges from session-end to twenty-four (24) months, depending on type.
Once retention periods lapse, data are securely erased, anonymised, or archived in compliance with PDPL and industry standards.
We employ a defence-in-depth approach that includes:
Transport-Layer Security (TLS 1.3) for all data in transit;
AES-256 encryption for data at rest;
Tiered network segmentation and firewalls;
Multi-factor authentication for privileged staff accounts;
Routine vulnerability scanning and annual penetration testing by CREST-certified assessors;
24/7 intrusion-detection and real-time log monitoring;
Strict vendor-risk assessments and data-processing agreements;
Incident-response protocols aligned with ISO / IEC 27035.
In the unlikely event of a personal-data breach that poses a risk to individuals, we will notify the UAE Data Office and affected users without undue delay, as required by PDPL Articles 9–10.
Subject to certain conditions, you may exercise the following rights with respect to your Personal Data:
Access – obtain confirmation whether we process your data and receive a copy;
Rectification – correct inaccurate or incomplete data;
Erasure – request deletion where data are no longer needed or processing is unlawful;
Restriction – limit processing while a challenge is being resolved;
Portability – receive data in a structured, machine-readable format and/or have it transmitted to another controller;
Objection – object to processing based on legitimate interests, direct marketing, or automated decisions;
Withdraw consent – at any time, where processing relies on your consent;
Complain – lodge a complaint with the UAE Data Office or seek judicial remedy through the Dubai Courts.
To exercise any right, please contact our Data Protection Officer at privacy@[platform-name].com. We will respond within one (1) month or the shorter period mandated by PDPL
We may send you e-mails, SMS, in-app notifications, or browser push messages about listings, market insights, promotions, and events. Marketing communications are sent only when: (i) you have given explicit consent; or (ii) they relate to services you already use and you have not opted out. You can withdraw consent or change preferences at any time by:
Selecting “Unsubscribe” at the bottom of any marketing e-mail;
Adjusting the Notifications tab within your account dashboard; or
Using the Contact Us form on the Platform to request removal from marketing lists.
Service and security alerts that are legally required or strictly necessary for your account are not subject to opt-out.
The Services are intended for adults engaged in real-estate transactions. We do not knowingly collect Personal Data from anyone under 18 years of age. If you are a parent or guardian and believe a minor has provided us with data, please notify us via the Contact Us form; we will promptly delete such information.
If we become aware of a personal-data breach likely to result in a risk to your rights or freedoms, we will:
Contain and investigate the incident through our incident-response team;
Notify the UAE Data Office within the timeframe required by the PDPL;
Inform affected users without undue delay via their registered e-mail address or in-app alert, describing the nature of the breach, probable consequences, and recommended measures; and
Document the breach, corrective actions, and lessons learned for regulatory review.
The Platform may include links, widgets, or APIs that connect you to third-party websites and tools (for example, mortgage calculators, map services, or social-media feeds). We do not control those sites, and this Privacy Policy does not apply to them. Your interactions with external services are governed by their own privacy statements and terms, and you access them at your own risk.
We may update this Policy to reflect changes in law, technology, or our practices. Material amendments will be announced:
Via a prominent banner on the home page at least seven (7) days before they take effect; and/or
By e-mail to users with active accounts.
The “Last Updated” date below shows when the latest version was published. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.
This Privacy Policy and any dispute arising from it are governed by the laws of the Emirate of Dubai and, where applicable, the federal laws of the United Arab Emirates. The Courts of Dubai have exclusive jurisdiction. Nothing prevents the parties from first seeking to resolve disputes through negotiation or mediation.
If you have questions about this Privacy Policy, wish to exercise your PDPL rights, or need to raise a privacy concern, please reach out by any of the methods below:
In-Platform Contact Form: Select “Contact Us” from the footer or main menu and submit your enquiry.
We aim to acknowledge privacy requests within 48 hours and provide a substantive response within one (1) month, unless the PDPL requires a shorter period.