Privacy Notice

How VIII handles personal data

Background

This notice explains what personal data VIII collects, why, who receives it, how long it is kept and what rights you have. It is given under the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021.

In short: the Company runs VIII and is responsible for your personal data. We collect what we need to run your account, check who you are, handle deals and pay you, and to meet the anti-money-laundering, tax and real estate rules that apply to a Dubai brokerage. Analytics and advertising tags run only if you press Accept on the cookie banner; a few cookies of our own, including ones that record how you found us, are set without asking (clause 8). Our database is kept on our own server in the UAE, and some of our providers handle data outside the UAE (clause 10). You can download your data from your account, and ask us to correct, delete or limit it (clauses 13 and 14).

1. Words used in this notice

"VIII" means the platform and services provided at viii.ae by the Company ("Propertyana Real Estate"). "We", "us" and "our" mean VIII.

"You" means any person whose personal data we handle: a visitor to the website, a person who sends us an enquiry, a user with an account (a "Referrer"), or a person whose details reach us through a deal.

"Personal data" means any information that identifies a living person or can identify them when combined with other information. "Parties" means the buyers, sellers, landlords, tenants and other people involved in a deal a Referrer submits.

2. Who is responsible for your data

VIII is the controller of the personal data described in this notice. This means VIII decides why and how that data is used and is responsible for protecting it. As clause 18 explains, the controller in law is Propertyana Real Estate, which owns and operates VIII.

Propertyana Real Estate is the Company, a real estate brokerage in mainland Dubai, licensed by the Dubai Department of Economy and Tourism (commercial licence the Company) and registered with the Real Estate Regulatory Agency (office registration number the Company).

For any question about this notice or your data, contact us through the contact details published on the VIII website, and mark your message "Privacy".

3. What we collect

We collect only what we need for the purposes in clause 5. Depending on how you use VIII, this may include:

(a) Sign-up data: your name, mobile number and email address, your chosen plan and your settings.

(b) Sign-in and security data: one-time codes (OTP) sent to your mobile by text message (or, as a fallback, by phone call) or to your email; the time and result of each sign-in; the IP address and device and browser details of each signed-in session; and a log of actions taken in your account, especially actions that affect money or access.

(c) Identity check data: if you use the face check, the identity document and the face image or video you provide to our identity verification provider, Didit, and the result it returns to us (see clause 6). If you upload your passport instead, the copy you upload and our staff member's decision.

(d) Screening data: we screen your name, and the names of the Parties to a deal you submit, against the UN Consolidated List and the UAE Local Terrorist List and, where we use a screening provider, against other sanctions lists, lists of politically exposed persons and adverse media. We repeat the check every day for active accounts and for the Parties to open deals, and we keep the result of each check and of any review by our staff.

(e) Payout data: your bank account number (IBAN), SWIFT code, the account holder name and your bank, so that Referral Fees are paid only to an account in your own name. Where relevant, your tax registration status.

(f) Subscription and payment data: your plan, start and renewal dates, discounts or invitation codes applied, invoices, and each payment as reported by our payment processor, Stripe. Card details are entered with Stripe and held by Stripe. VIII does not receive or store your full card number.

(g) Deal data and documents: the deal type, property, price or rent, status, and the documents you upload, such as the Parties' passports or Emirates IDs, title deeds, sales offers, tenancy details and payment proofs. These documents contain the Parties' personal data. Under the Deal Concierge service we may also collect documents from you in person.

(h) Messages: what you send us and what we send you through the website, WhatsApp, email or phone, including call notes. When you press the Help button, we record whether you asked for a WhatsApp message or a call, the mobile number to use, your note and the page you were on.

(i) Acceptance evidence: when you accept a contract or submit a deal, we record your name, the date and time, your IP address, your browser details (user agent), the document version you accepted and, for deals, a digital fingerprint (hash) of every uploaded file. A hash lets us prove later that a file has not changed.

(j) Member referral data: who invited whom, and the payments and rewards that follow from an invitation.

(k) Cookies and analytics data: see clause 8.

(l) How you found us: if you first came to VIII through a campaign link, such as a link in an advert, a post or a message, the campaign details in that link, the page you first landed on and the date of that first visit (see clause 8).

(m) Landing page and promo code: which of our two home pages first brought your browser to VIII, and the promo code of any promo link you opened or code you entered when you signed up (see clause 8).

(n) Enquiries: if you send us an enquiry through the website without opening an account, your name, your mobile number, your message and which of our home pages you came from.

Most of this data comes from you. Some comes from others: the Parties' data from the Referrer who submits a deal; identity check results from Didit; payment events from Stripe; and screening results from the sanctions lists and any screening provider we use. Sign-up, sign-in and deal forms show which details are required. Without them we cannot open your account, register a deal or pay you.

4. Personal data of other people that you upload

When you submit a deal, you give us personal data about the Parties. Before you do so, you must (a) have a lawful reason to share it, (b) have the Parties' consent to share it with VIII for the deal, and (c) tell them that VIII will handle their data as this notice describes. You confirm this each time you submit a deal. Do not upload documents that are not needed for the deal.

We use the Parties' data only to (a) verify that the deal is genuine and that the people and documents are real, (b) prepare Forms A, B and F for a secondary sale or the tenancy contract for a rental, and the other documents the deal needs, (c) carry out the brokerage work on the deal, (d) meet our legal duties, including anti-money-laundering checks, record-keeping and registration with the authorities, and (e) protect our legal rights if a dispute arises.

We do not rely only on the consent the Referrer collects. Our lawful basis for handling the Parties' data is that the processing is necessary (a) to take the steps a Party asks for before a contract is made and to perform the brokerage, sale or tenancy contracts to which the Party is a party, (b) to meet the legal duties that apply to a real estate brokerage, including customer due diligence under the anti-money-laundering laws of the UAE and the forms, contracts and registrations the Dubai Land Department and its Real Estate Regulatory Agency require, and (c) to establish, exercise or defend legal claims. The Referrer's confirmation of consent makes the Referrer's own act of sharing lawful and is an added safeguard.

When we first contact a Party about a deal, we tell them that VIII holds their data for that deal and where to read this notice.

A Party who wants to know what we hold about them, or to exercise any right in clause 13, can contact us directly. We do not need the Referrer's permission to answer them.

If we find that data was shared without a lawful reason or consent, we may stop the deal, delete the data where the law allows, and act under our Terms and Conditions.

5. Why we use personal data and on what basis

The UAE Personal Data Protection Law allows us to process personal data with your consent, or without consent where the processing is necessary for a reason the law recognises. We rely on the following:

(a) Performing our contract with you, or taking steps you ask for before one: creating and running your account, taking subscription payments, applying a promo code or invitation you signed up with, handling deals, calculating and paying Referral Fees and member referral rewards, answering enquiries and Help requests, and giving support.

(b) Meeting our legal duties: identity checks, anti-money-laundering and sanctions screening, tax and accounting records, real estate regulation, reports to authorities where the law requires them, and keeping records for the periods the law sets.

(c) Establishing, exercising or defending legal claims: keeping acceptance evidence, file hashes and account logs so that we can prove what was agreed and what happened.

(d) Security and fraud prevention: detecting fake deals, false documents, account takeover and misuse of the platform. We do this because it is necessary to perform our contract with you safely, to meet our legal duties under (b) and to protect legal claims under (c).

(e) Your consent: for marketing messages, for analytics and advertising cookies and tags (clause 8), and for the identity check where it uses your face image. You can withdraw consent at any time, as clause 13 explains.

(f) Counting which campaigns bring members: we keep how you found us (clause 3(l) and (m)) with your account and use it only to count, by campaign and by home page, how many sign-ups, paid plans and deals each one brings.

We do not sell, rent or trade personal data.

We do not make decisions about you based only on automated processing that have a legal or similarly significant effect on you. Automated tools may flag a deal or a payment for review. A possible match in sanctions screening holds the deal until a person at VIII has reviewed it, and a person at VIII makes the decision. If Didit's automated check does not verify you, you can ask for your passport to be checked by our staff instead.

6. Identity checks

Before we pay any Referral Fee, we verify your identity. You can do this in one of two ways: (a) a face check run for us by Didit, an identity verification company in Spain, which processes the data on its servers in the European Union. Didit asks for your identity document and a live face image or video, checks that the document is genuine, compares the face with it, and tells us whether the check passed; or (b) uploading a copy of your passport, which a member of our staff checks. The identity check screen names the provider and where it processes the data before you start.

A face image used to identify you is biometric data, which the law treats as sensitive personal data. When the check uses a face scan, we ask for your explicit consent on screen before it starts. If you do not consent, you can still use VIII, but payouts stay on hold until your identity is verified another way we accept, such as a check of your passport by our staff.

We do not store the face image, or Didit's photos of your document, on our own systems. We keep the result of the check, Didit's reference, the details Didit reads from your document (such as your name, date of birth and document number), the scores and warnings it returns, and the time and IP address of your consent, for the period in clause 11(c). Didit keeps its own records under its own terms. If you upload your passport instead, we keep that copy on our own systems for the same period.

You may withdraw your consent at any time by contacting us. Withdrawal stops any further face check but does not undo a check already made, and we keep the records the law requires.

7. Messages and marketing

We send service messages that you need in order to use VIII: one-time codes, deal and payment updates, reminders to complete your profile, contract changes and security alerts. We send them by text message through Twilio (and, as a fallback, by phone call), by email through SendGrid and, where available, by WhatsApp. These cannot be switched off while your account is open.

When you press the Help button, our team contacts you by WhatsApp or by phone, whichever you choose.

We send marketing messages, such as news, offers and invitations to events, only if you have agreed to receive them. You can stop them at any time by following the opt-out instructions in the message or by contacting us. Stopping marketing does not affect your account.

8. Cookies and analytics

Cookies are small files a website stores in your browser. Some are set by VIII itself. Others are set by the analytics and advertising companies whose tags we load only after you accept them. VIII uses:

(a) Essential cookies, which keep you signed in, protect forms against misuse, and remember your cookie choice and basic settings such as light or dark display. The site cannot work without them. The list below sets out each cookie.

(b) Analytics tools: Google Analytics, which tells us how the website is used so that we can improve it. Part of this data passes through our own server-side Tag Manager container at sgtm.viii.ae, which runs on Google's cloud, before it reaches Google.

(c) Advertising tags, which measure our advertising: Google Ads, the Meta Pixel (Meta runs Facebook and Instagram) and the TikTok Pixel.

(d) A campaign cookie, called "first_touch". When you first open the VIII website through a campaign link (a link that carries campaign tags such as the source, the medium or the campaign name), the website stores one cookie in your browser. It holds the campaign tags from that link, the page you landed on and the date. It does not hold your name, your contact details, your IP address, your device details or anything you type, and the analytics tools and advertising tags on our pages cannot read it. It lasts 30 days, and a later campaign link does not replace it. If you sign up within those 30 days, we copy these details to your account and delete the cookie. We use them to count how many sign-ups, paid plans and deals each campaign brings, and we report those counts by campaign, not by person. The details stay with your account data for the period in clause 11(a), are included when you download your data, and are not shared with anyone outside VIII.

(e) A landing page cookie, called "lp". When you open our home page, the website stores which of our two home pages brought you ("a" or "b") for 90 days. If you sign up or send an enquiry, we save it with your account or your enquiry so that sign-ups can be counted by page. Unlike the campaign cookie, the page can read it. If you have accepted analytics cookies, Google Tag Manager reads it and sends it to Google Analytics with your visit.

(f) A promo cookie, called "promo". If you open a VIII promo link (an address starting viii.ae/p/), the website stores that promo code for 30 days, so that its offer can be applied if you sign up. At sign-up we save the code with your account.

Analytics tools and advertising tags are loaded through Google Tag Manager, a service of Google, and only after you press Accept on the cookie banner. Until then none of them is loaded, and they are never loaded on our staff back office. Once loaded, they may read your IP address, device identifiers and the addresses of the pages you visit. Google, Meta and TikTok may process that data outside the UAE and also use it for their own purposes, as their own privacy notices explain. Essential cookies do not need consent.

The campaign, landing page and promo cookies in (d), (e) and (f) are set on your first visit, before you answer the cookie banner, and pressing Reject does not remove them.

The cookies we use:

sid (VIII): keeps you signed in. Lasts 30 days. Set when you sign in.

csrf (VIII): protects forms against misuse. Lasts 12 hours. Set on your first visit, before you choose on the banner.

cookie_consent (VIII): remembers whether you pressed Accept or Reject. Lasts 12 months. Set when you make your choice.

theme (VIII): remembers light or dark display. Lasts 12 months. Set only if you switch the display.

view (VIII): remembers the staff or member view, for staff accounts only. Lasts 12 months.

first_touch (VIII): records the campaign link that first brought you (see (d)). Lasts 30 days, or until you sign up. Set on your first visit, before you choose on the banner.

lp (VIII): records which home page brought you (see (e)). Lasts 90 days. Set on your first visit, before you choose on the banner.

promo (VIII): keeps the code from a promo link (see (f)). Lasts 30 days. Set on your first visit, before you choose on the banner.

_ga, _ga_..., _gid (Google Analytics): analytics. Lasts as set by Google, up to 2 years. Only after you press Accept.

FPID, FPLC (our server-side Tag Manager container): analytics. Lasts as set by Google, up to 2 years. Only after you press Accept.

_gcl_... (Google Ads): advertising measurement. Lasts as set by Google, about 90 days. Only after you press Accept.

_fbp, _fbc (Meta Pixel): advertising measurement. Lasts as set by Meta, about 90 days. Only after you press Accept.

_ttp, _tt_enable_cookie, ttcsid... (TikTok Pixel): advertising measurement. Lasts as set by TikTok. Only after you press Accept.

When you send certain forms, the page keeps a temporary copy of what you typed in your browser tab (session storage), so that it can put your answers back if the form is refused. The copy is deleted the next time the page loads and is never sent to us or anyone else.

You can refuse or withdraw cookie consent at any time with the "Cookie settings" link at the foot of every page, or by contacting us. Withdrawal stops the analytics tools and tags from then on, and the page removes the analytics and advertising cookies it can reach. The FPID cookie cannot be removed by the page and expires on its own. You can also block or delete cookies in your browser, but you may then be signed out and essential features may stop working.

9. Who we share it with

We share personal data only where needed for the purposes in clause 5, and only as much as each recipient needs:

(a) our payment processor, Stripe, to take subscription payments and handle refunds and disputed charges;

(b) our identity verification provider, Didit, for the face check (clause 6), and, if we use one, a screening provider that checks names against sanctions and other compliance lists, to which only the name is sent;

(c) our messaging providers: Twilio, which sends one-time codes by text message and, as a fallback, by phone call; SendGrid, part of Twilio, which sends our emails; and WhatsApp, a service of Meta, which our team uses to message you;

(d) Cloudflare, whose network every visit to the website passes through, to protect the site and connect it to our server; and our other hosting, storage and technology providers, which hold and process data for us;

(e) our banks, to pay Referral Fees and rewards;

(f) our professional advisers, such as accountants, auditors and lawyers, under a duty of confidentiality;

(g) the other side of a deal, its representatives, any co-broker, developer, bank or registration trustee involved in the deal, only as far as the deal requires;

(h) the Referrer who submitted a deal, limited to the deal's status and what the Referrer needs to follow it;

(i) government authorities and regulators, such as the Dubai Land Department and the Real Estate Regulatory Agency, tax authorities and the Financial Intelligence Unit, where the law requires it or a deal must be registered;

(j) police, courts, public prosecution and other law enforcement bodies, where the law requires it or where needed to establish or defend legal claims;

(k) a buyer or successor of all or part of the business, bound to use the data as this notice describes;

(l) Google, Meta and TikTok, through the analytics tools and advertising tags in clause 8, only if you have accepted them;

(m) Apple or Google, if you choose to add your VIII invite card to Apple Wallet or Google Wallet, where that feature is available. The card carries your name and your invite link.

Our service providers in (b), (c) and (d) act on our instructions and must protect the data under written terms. They may not use it for their own purposes. Stripe, in (a), also uses payment data for its own fraud prevention and legal duties, and Google, Meta and TikTok, in (l), decide for themselves how they use the data their tags collect. Each of them explains this in its own privacy notice.

10. Transfers outside the UAE

Our database and the documents you upload are kept on our own server in the UAE, and so are its backup copies.

Personal data leaves the UAE in these cases: card and subscription data with Stripe; the face check with Didit, in the European Union; names sent for screening to a screening provider, where we use one; text messages, phone calls and emails through Twilio and SendGrid; WhatsApp messages through Meta; website traffic through Cloudflare's network; and, if you accept them, analytics and advertising data with Google, Meta and TikTok. These providers store or process data outside the United Arab Emirates, for example in the European Union or the United States.

We transfer personal data outside the UAE only in the ways the UAE Personal Data Protection Law permits. This means the destination has an adequate level of protection, or we have a written contract that binds the recipient to protect the data to the standard UAE law requires, or another ground the law allows applies, such as the transfer being necessary to perform our contract with you or with your explicit consent.

You can ask us, through the contact details in clause 2, which safeguard applies to a transfer of your data.

11. How long we keep it

We keep personal data only for as long as we need it for the purposes in this notice:

(a) Account data: while your account is open, and afterwards for as long as needed to settle payments, answer questions and meet the duties below. Closing your account does not erase it: we mark it closed, stop it being used to sign in, and keep the records described in this clause. The same applies if we close or delete an account ourselves.

(b) Deal data, documents and payment records: for the period the tax, accounting and real estate laws of the UAE require.

(c) Anti-money-laundering records, including customer due diligence documents, identity check results and screening records: for at least five years after the business relationship ends or the transaction is completed, or longer where the anti-money-laundering laws of the UAE or an authority require it.

(d) Contracts and acceptance evidence: for as long as a claim could arise from them.

(e) Party documents from a deal that is declined or withdrawn before we act for the Parties: only for as long as needed to answer questions or claims about that submission, to deal with suspected fraud and to meet any reporting duty, and then we delete them. We keep the deal record and file hashes as evidence of what was submitted.

(f) How you found us (clause 3(l) and (m)): with your account data, for the period in (a). The cookies themselves last as clause 8 says.

(g) Enquiries from people without an account: for as long as needed to answer them and follow them up.

(h) Sign-in records: a signed-in session lasts at most 30 days, and its record is deleted when it ends. Records used to limit repeated attempts are deleted after one day. The log of account actions is kept with your account data.

(i) Backup copies: a copy is made every night on our own server and kept for 30 days.

Where different rules apply, we keep the data for the longest period that applies. When the period ends, we delete the data or make it anonymous. We may keep data longer if it is needed for a dispute, an investigation or a legal claim, until that matter ends.

12. How we protect it

We use technical and organisational measures suited to the risk. These include encrypted connections, sign-in with one-time codes, access limited by role to staff who need the data, logs of actions that affect money or access, file hashes that reveal changes to uploaded documents, and confidentiality duties for staff and providers.

No system is completely secure, and we cannot guarantee that data will never be lost or accessed without permission.

If a breach affects your personal data, we will notify the UAE Data Office and you where and as the law requires.

13. Your rights

Under the UAE Personal Data Protection Law, and subject to the conditions and exceptions it sets, you have the right to:

(a) know what personal data we hold about you, why we use it, who receives it inside and outside the UAE, how long we keep it, whether any decision about you is made by automated processing, how it is protected when it leaves the UAE, how to have it corrected or deleted, what we do if there is a breach and how to complain, and receive a copy (information and access);

(b) have inaccurate or incomplete data corrected (correction);

(c) have your data deleted when we no longer need it or have no lawful reason to keep it (deletion);

(d) ask us to limit how we use your data while you dispute its accuracy or object to its use, where it is processed unlawfully, or where we no longer need it but you need it kept for a legal claim (restriction);

(e) object to processing, including for marketing, and to decisions based only on automated processing (objection);

(f) receive data you gave us in a structured, commonly used format, or have it sent to another controller, where this applies (portability);

(g) withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.

Some rights are limited by law. For example, we cannot delete records that the anti-money-laundering, tax or real estate laws of the UAE require us to keep, and we may keep data needed for a legal claim. If we cannot meet a request in full, we will tell you why.

If you have an account, you can do much of this yourself on your Account page:

"Download my data" gives you a file with your account details, how you found us, your subscriptions, your deals and the list of documents you uploaded, your payouts and bank account, your referrals, the contracts you accepted, the devices signed in to your account and your recent account activity. It does not include everything we hold, for example identity check and screening results; ask us for those.

You can correct your name, email address and mobile number, and see and sign out the devices signed in to your account.

You can freeze your account. While it is frozen, your plan is not charged, you cannot register new deals and payouts wait. Everything is kept, and you can unfreeze it at any time.

You can close your account. Clause 11(a) explains what we keep.

You can change your cookie choice at any time with "Cookie settings" at the foot of every page.

14. How to exercise your rights

Send your request through the contact details published on the VIII website, marked "Privacy". Tell us which right you want to use and what data it concerns. A Party to a deal, or a visitor without an account, can use the same route.

We may ask you to prove your identity before we act, to protect your data from someone posing as you. We ask only for what we need to confirm it is you. We answer within 30 days after we receive a verified request, or within any shorter period the law sets. If a request is complex or one of many, we tell you within those 30 days and answer within a further 30 days. Requests are free of charge unless the law allows a fee.

If you are not satisfied with our answer, you may complain to the UAE Data Office, or the authority that takes over its role, or any other authority the law makes competent for data protection.

15. Children

VIII is not for anyone under 18. We do not knowingly collect personal data from children to open accounts. If we learn that a person under 18 has opened an account, we will close it and delete the data unless the law requires us to keep it.

A deal document may contain a minor's details, for example where a minor owns or occupies a property. We use that data only for the deal and our legal duties, as clause 4 describes.

16. Changes to this notice

We may update this notice when our services, providers or the law change. Each update is published on the VIII website as a new version with its date. We keep earlier versions, and we will send you one if you ask.

If a change is material, for example a new purpose or a new kind of recipient, we will tell account holders in advance by message, email or a notice at sign-in.

17. Law

This notice is governed by the laws of the Emirate of Dubai and the applicable federal laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. The English text governs. An Arabic translation may be prepared for any court or authority.

18. VIII and Propertyana Real Estate

VIII is a product of Propertyana Real Estate (the Company). Propertyana Real Estate owns and operates VIII and holds the brokerage licence under which every VIII service is provided.

Anything done by or through VIII is done by Propertyana Real Estate. Every right and obligation of "VIII" under this notice, including its role as controller of personal data, is a right and obligation of Propertyana Real Estate.

This notice creates no personal liability for the owners, managers, employees or representatives of Propertyana Real Estate. Any claim about personal data handled by VIII lies only against Propertyana Real Estate.