Privacy Policy

Realtor Signature Properties L.L.C S.O.C ("Realtor Signature", "we", "us", "our") is a real estate brokerage licensed by the Dubai Land Department (Licence No. 1592665) and registered with the Real Estate Regulatory Agency (RERA Office Registration No. 59128) for real estate buying and selling brokerage and leasing property brokerage. We are the data controller of the personal data described in this Privacy Policy. Our registered office is 107-A29, White Swan Building, Trade Center First, Dubai, United Arab Emirates.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you:

• visit or use www.realtoruae.com (the "Website"), including the Signature Guide AI search assistant and any enquiry, contact or shortlist forms;
• contact us by telephone, email, WhatsApp, social media or in person;
• engage us for property sales, resale, off-plan allocation, leasing and rental brokerage, mortgage advisory and brokerage, UAE Golden Visa assistance or related advisory services (the "Services");
• are a landlord, seller, buyer, tenant, investor, developer contact, referrer, supplier, job applicant or other person whose data we process in the course of our business.

We are committed to processing personal data lawfully, fairly and transparently and in accordance with:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and its implementing regulations and guidance issued by the competent UAE federal data protection authority;
• the Dubai International Financial Centre Data Protection Law (DIFC Law No. 5 of 2020) and the Abu Dhabi Global Market Data Protection Regulations 2021, to the extent any of our processing falls within those free zones;
• UAE Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, UAE consumer-protection and anti-money-laundering legislation, and Dubai Land Department / RERA rules applicable to real estate brokers;
• the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR and Data Protection Act 2018, where we offer Services to, or monitor the behaviour of, individuals in the European Economic Area, Switzerland or the United Kingdom;
• the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and other applicable US state privacy laws, and the privacy laws of Canada, India, Australia, Brazil, Singapore, Saudi Arabia and other jurisdictions where we interact with residents of those countries (see Section 12).

If you are a resident of a country whose law gives you rights beyond those described here, those rights apply to you and we will honour them. If anything in this Policy conflicts with a mandatory requirement of the law that applies to you, that law prevails.

By using the Website or the Services, or by providing personal data to us, you acknowledge that you have read and understood this Policy. Where the law requires your consent (for example, for marketing or non-essential cookies), we will ask for it separately and you may withdraw it at any time.

• Personal data means any information relating to an identified or identifiable natural person, directly or indirectly, including name, identification numbers, location data, online identifiers and factors specific to a person's physical, economic, cultural or social identity.
• Sensitive (special category) personal data means data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, health, genetic or biometric data, sexual orientation, criminal record, and (under the UAE PDPL) family or financial data where treated as sensitive. We collect such data only where strictly necessary and lawful.
• Processing means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transfer, restriction, erasure or destruction.
• Controller means the entity that determines the purposes and means of processing. For the purposes of this Policy, the controller is Realtor Signature Properties LLC.
• Processor means a third party that processes personal data on our behalf and under our instructions (for example, our CRM, email and hosting providers).
• Data subject / you means the individual to whom personal data relates.
• Cross-border transfer means the transfer of personal data to a recipient located outside the UAE (or outside your home jurisdiction).
• Applicable data protection law means all laws listed in Section 1 and any other privacy or data protection law that applies to our processing of your personal data.

3. Personal data we collect

We collect only the personal data we need for the purposes described in Section 5. The categories below depend on how you interact with us; not all categories apply to every person.

We do not knowingly collect personal data from children under 18 (see Section 15). If you provide us with personal data about another person (for example, a co-buyer, spouse, tenant or employee), you confirm that you are authorised to do so and have informed them of this Policy.

4. How we collect personal data

Directly from you — when you submit an enquiry, contact or "Speak to an adviser" form; use the Signature Guide AI search; call, email or WhatsApp us; register for a property launch, viewing or event; sign a brokerage, reservation or tenancy document; apply for mortgage or Golden Visa advisory; apply for a job; or otherwise communicate with us.

Automatically — when you browse the Website, through cookies, pixels, server logs, analytics tools and similar technologies (see Section 6). When you message us on WhatsApp, Meta's WhatsApp Business platform processes your number and message content under WhatsApp's own privacy terms.

From third parties — including:

• property developers and master developers (for allocation, registration and after-sales matters);
• the Dubai Land Department, RERA, Dubai REST / Trakheesi, and other UAE government and municipal authorities;
• banks, mortgage lenders and mortgage brokers (with your authorisation);
• your lawyers, conveyancers, financial advisers, co-owners or authorised representatives;
• property portals and lead-generation partners (for example, Property Finder, Bayut or Dubizzle) when you enquire about one of our listings there;
• Meta (Facebook/Instagram), Google and other advertising platforms when you respond to our advertisements or lead forms;
• referral partners, immigration consultants and relocation agents who introduce you to us;
• identity-verification, sanctions-screening and AML-screening providers;
• publicly available sources such as company registers, where lawful and necessary for KYC.

We will tell you if providing particular data is mandatory (for example, identity documents required by UAE law before we can transact) and what happens if you do not provide it.

We process personal data only where we have a lawful basis. The bases below reflect the UAE PDPL, GDPR/UK GDPR and equivalent laws; where a law recognises fewer bases, we rely on the closest equivalent (under the UAE PDPL, principally consent, contract, legal obligation, legitimate interests permitted by law, and public/vital interest).

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms, and you may object at any time (Section 11). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. We will not use your personal data for a purpose incompatible with the purpose for which it was collected without telling you and, where required, obtaining your consent.

The Website uses cookies, pixels, tags, local storage and similar technologies. On your first visit we display a consent banner; non-essential cookies are set only after you opt in, and you can change or withdraw your choices at any time via the "Cookie settings" link in the Website footer or through your browser settings.

We honour browser-level Global Privacy Control (GPC) and "Do Not Track" signals where the applicable law treats them as a valid opt-out (for example, California). Third parties that set cookies through our Website process data under their own privacy policies: Google and Meta. We do not use cookies to collect sensitive personal data.

A full, regularly updated list of the cookies in use, their providers and lifetimes is available in our Cookie Policy at www.realtoruae.com/cookies.

7. How we share personal data

We do not sell personal data, and we do not share it with third parties for their own marketing without your consent. We share personal data only as described below, and only to the extent necessary.

We require every processor to sign a contract that meets the requirements of the UAE PDPL and, where relevant, Article 28 GDPR / UK GDPR, and we do not allow them to use your data for their own purposes. A current list of our principal sub-processors is available on request from the contact in Section 19.

8. International data transfers

We are based in the UAE and primarily store personal data on servers located in the UAE or in data centres operated by our cloud providers. Because our clients, developers, lenders and service providers are located worldwide, your personal data may be transferred to, stored in or accessed from countries outside the UAE and outside your country of residence, including the European Economic Area, United Kingdom, United States, India and other jurisdictions.

Whenever we transfer personal data across borders we ensure an appropriate level of protection by relying on one or more of the following:

• a decision by the competent UAE authority, the European Commission, the UK Secretary of State or another relevant regulator that the destination provides adequate protection;
• binding contractual safeguards, including the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and equivalent clauses approved or recognised under the UAE PDPL, DIFC or ADGM regimes, together with supplementary technical measures such as encryption;
• your explicit consent to the transfer after being informed of the possible risks;
• the transfer being necessary for the performance of a contract with you or concluded in your interest, for the establishment, exercise or defence of legal claims, or for an obligation under UAE law or an international judicial cooperation arrangement.

You may request a copy of the safeguards we use for a particular transfer by contacting us (Section 19). We do not transfer personal data to a country or recipient where we cannot ensure appropriate protection.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purposes in Section 5, to comply with legal, regulatory, tax and accounting obligations, and to establish, exercise or defend legal claims. Our standard retention periods are:

When the retention period ends we securely delete or irreversibly anonymise the data. Where deletion is not immediately possible (for example, in backups), we isolate the data from further processing until deletion is possible.

10. How we protect personal data

We apply technical and organisational measures appropriate to the risk, in line with the UAE PDPL, Article 32 GDPR and recognised standards such as ISO/IEC 27001. These include:

• encryption of personal data in transit (TLS 1.2 or higher) and at rest;
• role-based access controls, multi-factor authentication and least-privilege access to CRM and document systems;
• secure, access-logged storage of identity documents and financial records, with no storage on personal devices or unmanaged messaging apps;
• regular vulnerability management, patching, malware protection and backups with tested recovery;
• contractual security obligations and due diligence for all processors;
• staff confidentiality undertakings, background checks where lawful, and regular privacy and security training;
• data-minimisation, pseudonymisation and anonymisation where practicable;
• incident-response and breach-notification procedures (Section 17);
• data protection impact assessments for high-risk processing, including new technology such as AI-assisted search.

No method of transmission or storage is completely secure. You are responsible for keeping any passwords confidential and for using secure channels when sending us documents; we will never ask you for payment to a personal bank account or for your online banking credentials.

Subject to the law that applies to you and to certain legal exceptions, you have the following rights in relation to your personal data:

How to exercise your rights. Email us at [email protected] or write to the address in Section 19 stating your name, contact details, the right you wish to exercise and the data concerned. You may authorise an agent to act for you; we will require evidence of the authorisation. We may ask for information to verify your identity (and will use it only for that purpose).

Timing and cost. We respond without undue delay and in any event within one month (or the shorter period required by your local law, such as 45 days under the CCPA with one possible extension, or the period set by the UAE PDPL implementing regulations). We may extend the deadline by up to two further months for complex or numerous requests and will tell you if so. There is no charge unless a request is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline.

Limits. We may refuse or limit a request where the law permits, for example where fulfilling it would breach a legal duty (such as AML record-keeping), prejudice legal proceedings, or disclose another person's data. We will explain the reason in writing.

United Arab Emirates (mainland). We process personal data in accordance with the UAE PDPL, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. We maintain a record of processing activities, carry out data protection impact assessments for high-risk processing, and notify personal data breaches to the competent UAE data protection authority and, where required, to affected individuals. Where the UAE PDPL requires consent, consent is specific, clear, unambiguous and freely given, and withdrawal is as easy as giving it. You may complain to the UAE Data Office or its successor federal authority. Brokerage-related data is also handled in line with Dubai Land Department and RERA requirements.

DIFC and ADGM. If we process personal data of individuals located in, or in connection with activities in, the DIFC or ADGM, the DIFC Data Protection Law 2020 or the ADGM Data Protection Regulations 2021 apply, and you may complain to the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection respectively.

European Economic Area, Switzerland and United Kingdom. Where the GDPR, Swiss FADP or UK GDPR applies, Realtor Signature Properties LLC is the controller. You have the rights in Section 11 and may complain to your local supervisory authority, the Information Commissioner's Office (UK) or the Swiss Federal Data Protection and Information Commissioner. Where the law requires us to appoint a representative in the EU or UK under Article 27, their contact details will be published in Section 19. International transfers to the UAE are safeguarded as described in Section 8.

United States — California (CCPA/CPRA) and other states. In the preceding 12 months we have collected the categories of personal information listed in Section 3 for the purposes in Section 5 and disclosed them to the recipients in Section 7 for business purposes. We do not sell personal information for money. Advertising cookies may constitute "sharing" for cross-context behavioural advertising; you can opt out via the cookie banner, the "Do Not Sell or Share My Personal Information" link in the Website footer, or by enabling Global Privacy Control. We do not knowingly sell or share personal information of consumers under 16. California residents also have the right to know, delete, correct, limit use of sensitive personal information and be free from discrimination. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws have comparable rights, including to appeal a refused request by emailing [email protected] with "Appeal" in the subject line.

Canada. We comply with PIPEDA and applicable provincial laws. We obtain meaningful consent for the collection, use and disclosure of personal information and may transfer it outside Canada, where it may be accessible to foreign authorities under local law. You may complain to the Office of the Privacy Commissioner of Canada.

India. Where the Digital Personal Data Protection Act 2023 applies, we act as Data Fiduciary; you may nominate another person to exercise your rights, withdraw consent, and raise grievances with our Grievance Officer at [email protected] before approaching the Data Protection Board of India.

Australia. We comply with the Australian Privacy Principles under the Privacy Act 1988. Your data may be disclosed to overseas recipients in the UAE and the countries listed in Section 8. You may complain to the Office of the Australian Information Commissioner.

Brazil. Where the LGPD applies, you have the rights in Section 11 and may contact our Encarregado (data protection officer) at [email protected] or the Autoridade Nacional de Proteção de Dados.

Saudi Arabia, Qatar, Bahrain, Egypt and other GCC/MENA states. We respect the Saudi PDPL, Qatar Law No. 13 of 2016, Bahrain Law No. 30 of 2018, Egypt Law No. 151 of 2020 and similar laws, including their rules on consent, cross-border transfer and notification, when we deal with residents of those countries.

Singapore, Hong Kong, Japan, South Korea, Nigeria, South Africa and other jurisdictions. Where the PDPA (Singapore), PDPO (Hong Kong), APPI (Japan), PIPA (Korea), NDPA (Nigeria), POPIA (South Africa) or other local laws apply, we honour the rights and obligations they impose, including any local-storage or notification requirements, and you may contact us or your local regulator.

Russia, China and countries with data-localisation rules. We do not target the residents of these countries. If you are located there and contact us, your data is processed in the UAE as described in this Policy.

13. Marketing communications and your choices

We send property alerts, new-launch announcements, market updates and offers by email, SMS, WhatsApp, phone and social media only where you have opted in or, where the law allows, where you are an existing client and we are promoting similar Services. Every electronic message includes an unsubscribe link or reply instruction, and you can opt out at any time by:

• clicking "unsubscribe" in any email;
• replying STOP to any SMS or WhatsApp broadcast;
• adjusting your preferences in the Website cookie settings;
• emailing [email protected].

We will action your request within 10 business days (or sooner where the law requires) and will not use your data for marketing afterwards, although we may still send transactional or service messages about an ongoing transaction. We comply with UAE telecommunications and consumer-protection rules on unsolicited marketing, the EU ePrivacy Directive and UK PECR, the US CAN-SPAM and TCPA, Canada's CASL and equivalent laws, and we keep records of consent. We do not share your contact details with developers or third parties for their marketing unless you ask us to.

14. Automated decision-making, profiling and AI tools

The Signature Guide assistant and our CRM use automated processing to match your stated requirements (budget, area, property type, timeline) to listings and to prioritise follow-up. These tools assist our advisers; they do not make decisions that produce legal or similarly significant effects on you without human involvement. Mortgage eligibility and visa eligibility decisions are made by lenders and government authorities, not by us.

When you use Signature Guide, your queries and conversation content may be processed by a third-party AI provider acting as our processor under a contract that prohibits use of your data to train its models. Please do not enter identity documents, bank details or other sensitive information into the AI chat; use the secure channels your adviser provides.

You may ask us to explain any automated processing that affects you, to have a human review it, or to object to profiling for marketing purposes (Section 11).

15. Children's privacy

The Website and Services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18 (or under the age of digital consent in your jurisdiction, such as 13 in the United States or 16 in parts of the EEA). Where a minor's data is necessary for a transaction, for example a dependant on a Golden Visa application or a child named on a title deed, we collect it only from the parent or legal guardian with their consent. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

16. Third-party websites and services

The Website contains links to developer websites, property portals, mortgage lenders, government portals (such as the Dubai REST app and ICP), social-media platforms and WhatsApp. These are operated by third parties with their own privacy policies, and we are not responsible for their content or practices. When you follow a link, submit a form on a developer or lender site, or message us on a social or messaging platform, that platform's privacy policy also applies. We encourage you to read it before providing personal data.

17. Personal data breaches

We maintain an incident-response plan. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will:

• contain and assess the incident immediately and record it in our breach register;
• notify the competent UAE data protection authority and any other supervisory authority required by applicable law without undue delay and, where the law sets a deadline (for example 72 hours under the GDPR/UK GDPR and DIFC/ADGM rules), within that deadline;
• inform you without undue delay where the breach is likely to result in a high risk to you, describing the nature of the breach, the likely consequences, the measures taken and a point of contact;
• cooperate with regulators, law enforcement and affected partners such as developers or lenders.

If you suspect that your data held by us has been compromised, or you receive a suspicious communication claiming to be from Realtor Signature, contact us immediately at [email protected].

18. Changes to this Policy

We review this Policy at least annually and whenever our processing or the law changes. We will post the updated version on the Website with a new "Last updated" date and version number. For material changes that affect your rights, we will give you reasonable advance notice by email or a prominent Website notice and, where the law requires, seek your renewed consent. Earlier versions are available on request.

Controller: Realtor Signature Properties L.L.C S.O.C, 107-A29, White Swan Building, Trade Center First, Dubai, United Arab Emirates. Dubai Land Department Licence No. 1592665 · RERA Office Registration No. 59128.

Data Protection Officer / Privacy contact: [email protected] · +971 56 603 7833 · Attention: Data Protection Officer

EU / UK representative (Article 27): Not currently appointed. For EU/UK GDPR requests, email [email protected].

We aim to resolve any concern within 30 days. If you are not satisfied with our response, you may complain to the supervisory authority in your country, including:

Complaints about our brokerage conduct may also be made to the Dubai Land Department / RERA.

This Policy is governed by the laws of the United Arab Emirates, without prejudice to the mandatory data protection rights you enjoy under the law of your country of residence.