Privacy Policy

01Who we are

This Privacy Policy explains how Felicity Properties L.L.C, a real-estate brokerage based in Dubai, United Arab Emirates, holding commercial licence No. 1145910 issued by the Dubai Department of Economy and Tourism, registered with the Real Estate Regulatory Agency (RERA) of the Dubai Land Department under Office Registration Number (ORN) 33951 (“we”, “us” or “our”), which operates the OffplanDistress platform (the “Platform”), collects, uses, shares and protects personal data. We are the controller of that data for the purposes of UAE Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data (the “PDPL”).

This Policy applies to everyone who uses the Platform, including visitors, Buyers, Sellers and people who contact us. Capitalised words have the meanings given in our Terms of Use, which should be read together with this Policy and our Cookie Policy.

02The personal data we collect

We collect the following categories of personal data:

• Account data: your full name, email address, mobile number (if you give one), whether you want to buy, sell or both, your preferred language, a hashed form of your password, your identity-verification (KYC) status and the date and time you accepted our Terms of Use and this Policy.
• Listing data: details of your Unit (developer, project, community, type, size, floor and view), the purchase price, the amount paid, the payment plan, the asking price, how quickly you need to sell, whether any instalments have been missed (this is noted in the public Listing description) and the description you write.
• Documents: files you upload, such as the SPA, Oqood certificate, statement of account, passport or Emirates ID and any other supporting document. These are stored in our database and, on the Platform, are visible only to you and our authorised staff.
• Listing photographs: photographs of the Unit that you upload with a Listing. These are published with the Listing and anyone can view them; even while the Listing is under review, anyone who has a photograph’s web address can view it.
• Transaction data: Offers and counter-offers, financing preferences, messages for the other party, the status of each deal and the information needed for the NOC and the Transfer.
• Activity and preferences: your watchlist, saved searches and alert settings, and the in-app notifications and emails we send you.
• Enquiries: the name, email address, telephone number and message you send through our contact or viewing-request forms, or when you call us or message us on WhatsApp (including any figures you choose to send, such as those pre-filled from the exit calculator).
• Technical data: server logs containing your IP address, the pages requested and the date and time; rate-limit records containing your IP address and, for sign-in attempts, the email address entered; and the two cookies described in our Cookie Policy.

03Where the data comes from

Most of the personal data we hold is provided by you when you register, list a Unit, make an Offer, upload documents or contact us. Some is generated automatically when you use the Platform, such as server logs, rate-limit records and notifications.

In the course of a transaction we also receive information from Developers (for example, statements of account and NOC conditions), from the DLD and trustee offices, and from the other party to the transaction. To meet our legal obligations we may also check public sources, such as sanctions lists.

04Why we use it and our legal bases

We process personal data only on a ground the PDPL allows: your consent, or where the processing is necessary to perform a contract with you or to take steps you request before entering into one, to comply with obligations imposed on us by other UAE laws, or to establish, exercise or defend legal claims.

We do not sell personal data or use it for advertising. Where we rely on your consent, you may withdraw it at any time without affecting processing carried out before the withdrawal.

We use personal data to:

• create and manage your account, publish and manage Listings, present Offers and run watchlists, saved searches and notifications (necessary to perform our agreement with you under the Terms of Use);
• verify documents and broker your transaction, including requesting the NOC and arranging the Transfer (necessary to perform our brokerage agreement, including RERA Forms A and B, and to take the steps you request);
• verify your identity, check the source of funds, screen against sanctions lists, keep records and report suspicious activity (necessary to comply with our legal obligations, including under Federal Decree-Law No. (20) of 2018);
• keep the Platform and your account secure, prevent fraud and abuse, for example by limiting repeated sign-in attempts, and fix faults (necessary to perform our agreement with you and to meet our duty under the PDPL to protect personal data);
• answer your enquiries and viewing requests (steps you ask us to take);
• send saved-search alerts and price-drop emails for deals on your watchlist (at your request; you can turn off the alerts for each saved search at any time, and stop price-drop emails for a deal by removing it from your watchlist); and
• establish, exercise or defend legal claims and respond to lawful requests from courts, the DLD, RERA and other authorities.

05Who we share it with

We do not sell personal data. We share it only as follows:

• Other Users: until the MOU (RERA Form F) is prepared, a Seller sees the amount and terms of an Offer, any message the Buyer wrote, whether the Buyer will pay in cash or with a mortgage and whether the Buyer has completed our identity check, but not the Buyer’s name or contact details. Listings, which anyone can view, show details of the Unit and the photographs uploaded with it, but never the Seller’s name or contact details.
• Our team: authorised staff of Felicity Properties L.L.C can see both parties’ contact details and documents in order to verify Listings and manage transactions.
• Parties to your transaction: when the MOU is prepared, we disclose each party’s identity details to the other as needed to sign RERA Form F and complete the Transfer. When a deal proceeds, we also share what is needed with the Developer (to obtain the NOC and record the assignment), with the DLD and the trustee office (to register the Transfer) and with any bank the Buyer chooses for financing or payment.
• Service providers: Vercel hosts the Platform, Neon provides our database and Resend sends our transactional emails. They process personal data on our instructions in order to provide their services to us.
• WhatsApp: if you message us on WhatsApp, the conversation is carried by WhatsApp (Meta Platforms), which processes it under its own terms and privacy policy. Nothing is sent to WhatsApp unless you choose to open it and send the message.
• Image hosting: some photographs on the Platform, namely the background images of the home page and of the sign-in, sign-up and password-reset pages and some photographs on sample listings, are loaded by your browser directly from the servers of Unsplash. Unsplash therefore receives your IP address and browser details when your browser fetches them, and handles that information under its own privacy policy.
• Authorities: courts, regulators, law-enforcement bodies and the competent anti-money-laundering authorities, where the law requires or permits it.
• Advisers and successors: our professional advisers, who owe us a duty of confidentiality, and any buyer of all or part of our business, which would be bound by this Policy.

06International transfers

Some of our service providers store or process data outside the UAE. In particular, the servers of our database provider, Neon, may be located outside the UAE, our hosting and email providers operate internationally, Unsplash, which serves some photographs directly to your browser, operates outside the UAE, and so does WhatsApp (Meta Platforms) if you message us there.

When personal data is transferred outside the UAE, we transfer it only as the PDPL permits: to a country with an adequate level of data protection, or subject to appropriate safeguards, such as contractual commitments requiring the recipient to protect the data to a standard consistent with the PDPL, or otherwise on a ground the PDPL allows.

07How long we keep it

We keep personal data only for as long as we need it for the purposes described above or as the law requires:

• Account data: while your account is open. You can ask us to close your account at any time; when we close it, we delete or anonymise your account data within a reasonable time, except where we must keep it for the reasons below.
• Transaction and AML records: Listings, Offers, documents and records relating to a transaction, and the identity and source-of-funds information collected for anti-money-laundering purposes, for at least five years, as the law requires.
• Server logs: up to 30 days.
• Rate-limit records: deleted automatically once they are more than 24 hours old. The clean-up runs whenever a new attempt is recorded and at least once a day.
• Enquiries: as long as needed to respond and follow up, and afterwards only as part of the transaction records described above where relevant.

08Your rights

Subject to the conditions and exceptions set out in the PDPL, you have the right to:

• Access: obtain information about the personal data we hold about you, how we use it and who receives it, and a copy of it.
• Correction: have inaccurate or incomplete data corrected. You can update most account details yourself on the profile page of your dashboard.
• Deletion: ask us to erase personal data that we no longer need or that we process unlawfully.
• Restriction: ask us to restrict processing, for example while we check the accuracy of your data or consider an objection.
• Objection: object to processing, or ask us to stop it, in the cases the PDPL allows.
• Portability: receive the data you gave us in a structured, machine-readable format, or have it transferred to another controller where technically feasible.
• Withdrawing consent: withdraw your consent at any time where we rely on it, without affecting processing carried out before the withdrawal.
• Complaint: lodge a complaint with the UAE Data Office if you believe we have breached the PDPL.

09How to exercise your rights

To exercise any of these rights, write to mouhannad@felicitypro.com from the email address registered on your account. We may need to verify your identity before acting on a request, and we will respond within the period set by the PDPL and its implementing regulations.

Some rights are limited by law. For example, we cannot delete records that we must keep under anti-money-laundering rules or that we need for a transaction in progress. If we cannot meet a request in full, we will explain why.

10How we protect it

No method of transmission or storage is completely secure, but we protect personal data with technical and organisational measures appropriate to the risk. If a breach is likely to affect your privacy, we will notify you and the UAE Data Office as the PDPL requires. If you believe your account has been compromised, change your password and contact us immediately.

Our measures include:

• encryption in transit (TLS/HTTPS) on every page and between our servers and our database;
• passwords stored only as salted bcrypt hashes, never in readable form;
• httpOnly session cookies that scripts on the page cannot read, with only a hashed copy of each session token kept on our side;
• on the Platform, access to uploaded documents and contact details limited to the account holder and authorised staff (Listing photographs, which are published with the Listing, are the exception); and
• limits on repeated sign-in and sign-up attempts.

11Cookies

We use only two cookies, both strictly necessary: od_session keeps you logged in and od_locale remembers your language. We do not use analytics, advertising or third-party cookies. Our Cookie Policy explains them in detail.

12Children

The Platform is intended for adults. You must be 18 or over to create an account, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will delete it.

13Emails you receive

We send emails about your account and its security, including password resets; about your Listings and Offers, counter-offers and the progress of your deals; and, when the price of a deal on your watchlist drops, a price-drop email. We write in the language you last used on the Platform. Account, security and deal emails are part of the service and continue while your account is open. To stop price-drop emails for a deal, remove it from your watchlist. Most of these messages also appear as notifications in your dashboard; password-reset emails do not.

When you save a search, alerts are switched on by default: we email you when new matching deals are published, at most once a day. You can turn off the alerts for each saved search, or delete the saved search, at any time from the saved-searches page of your dashboard.

14Changes to this Policy

We may update this Policy from time to time, for example when we change service providers or the law changes. We will publish the new version on this page with a new “Last updated” date and, where the changes are significant, tell you by email or through the Platform.

15Contact us

For questions about this Policy or about how we handle your personal data, please contact Felicity Properties L.L.C:

• Email: mouhannad@felicitypro.com
• Telephone: +971 56 352 0611
• Address: Office 705, Building 12, Bay Square, Marasi Drive, Business Bay, Dubai, UAE
• RERA Office Registration Number (ORN): 33951
• Commercial licence No.: 1145910