Privacy Policy

1.1 The data controller for your personal data is:

1.2 We are registered in England and Wales and provide services in the United Arab Emirates.

1.3 For questions about this Policy or your personal data, contact us at hello@theassetstandard.ae.

2.1 We collect the following types of personal data:

Personal Identification Information:

• Name
• Email address
• Phone number
• Postal address
• Nationality (where required for regulatory compliance)

Property Information:

• Property address and location
• Property type and specifications
• Property ownership or interest details
• Transaction history (obtained from DLD and RERA)

Financial Information:

• Payment card details (processed securely through third-party payment processors)
• Billing address
• Transaction records

Technical Information:

• IP address
• Browser type and version
• Device information
• Cookies and similar tracking technologies
• Website usage data

Communication Data:

• Correspondence with us (emails, phone calls, messages)
• Feedback and survey responses
• Support requests

3.1 We collect personal data through the following methods:

• Directly from you: When you register, place an order, contact us, or use our services
• Government databases: We access DLD and RERA APIs to obtain property transaction history, service charge data, and developer records (with your authorization)
• Automatically: Through cookies, web beacons, and similar technologies when you visit our website
• Third parties: Payment processors, analytics providers, and service providers (in accordance with applicable law)

4.1 Under UK GDPR, we process your personal data based on the following legal bases:

• Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., marketing communications)
• Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
• Legal obligation: Processing is necessary for compliance with a legal obligation (e.g., tax records, regulatory requirements)
• Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests

4.2 You have the right to withdraw consent at any time, where consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

5.1 We use your personal data for the following purposes:

Service Provision:

• To provide property audit and due diligence services
• To generate and deliver audit reports
• To access and verify data from DLD and RERA databases
• To process payments and manage your account
• To communicate with you about your orders and services

Legal and Regulatory Compliance:

• To comply with UK and UAE legal obligations
• To comply with DLD and RERA regulations
• To maintain records for tax and accounting purposes
• To respond to legal requests and protect our rights

Business Operations:

• To improve our services and website
• To analyze usage patterns and trends
• To prevent fraud and ensure security
• To conduct research and analytics

Marketing (with your consent):

• To send you marketing communications about our services
• To provide updates and newsletters
• To inform you about new features and offerings

6.1 We do not sell your personal data. We may share your data with:

Government Authorities:

• Dubai Land Department (DLD) - for property data verification
• Real Estate Regulatory Agency (RERA) - for regulatory compliance
• UK and UAE tax authorities - for legal compliance
• Law enforcement agencies - when required by law

Service Providers:

• Payment processors - to process payments securely
• Cloud hosting providers - to store and process data
• Analytics providers - to analyze website usage
• Email service providers - to send communications
• IT service providers - for technical support

6.2 All third-party service providers are contractually obligated to:

• Process data only for specified purposes
• Implement appropriate security measures
• Comply with applicable data protection laws
• Not use data for their own purposes

6.3 We may disclose your data if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of others.

7.1 Your personal data may be transferred to and stored in countries outside the UK and UAE, including:

• European Economic Area (EEA) countries
• United States (for cloud hosting and analytics)
• Other countries where our service providers operate

7.2 We ensure appropriate safeguards are in place for international transfers:

• Standard Contractual Clauses (SCCs) approved by UK and EU authorities
• Adequacy decisions where applicable
• Binding Corporate Rules (BCRs) where available
• Other appropriate safeguards as required by law

7.3 By using our services, you consent to the transfer of your data as described in this Policy.

8.1 We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with UK GDPR Article 32 and UAE Federal Law No. 45 of 2021.

8.2 Our security measures include:

• Encryption of data in transit (SSL/TLS) and at rest
• Secure access controls and authentication
• Regular security assessments and updates
• Employee training on data protection
• Incident response procedures
• Regular backups and disaster recovery plans

8.3 Despite our security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

8.4 In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours, as required by UK GDPR and UAE data protection law.

9.1 We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law.

9.2 Our retention periods are based on:

• Legal requirements: UK tax law requires retention of financial records for 6 years; UAE law may require different retention periods
• Business needs: To provide ongoing services and support
• Dispute resolution: To defend against legal claims
• Regulatory compliance: DLD and RERA requirements

9.3 Typical retention periods:

• Account information: While your account is active and for 7 years after closure
• Transaction records: 7 years (UK tax law) or as required by UAE law
• Audit reports: 7 years from date of creation
• Marketing data: Until you withdraw consent or opt out
• Website analytics: 26 months (Google Analytics default)

9.4 After the retention period, we will securely delete or anonymize your personal data, unless we are required to retain it for legal purposes.

10.1 Under UK GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15):

You have the right to request a copy of the personal data we hold about you and information about how we process it.

Right to Rectification (Article 16):

You have the right to request correction of inaccurate or incomplete personal data.

Right to Erasure ("Right to be Forgotten") (Article 17):

You have the right to request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the original purpose or you withdraw consent.

Right to Restrict Processing (Article 18):

You have the right to request that we limit how we use your personal data in certain circumstances.

Right to Data Portability (Article 20):

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.

Right to Object (Article 21):

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22):

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

10.2 To exercise these rights, contact us at hello@theassetstandard.ae. We will respond within one month (or two months for complex requests) as required by UK GDPR.

10.3 You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with UK GDPR.

11.1 Under UAE Federal Law No. 45 of 2021, you have the following rights:

• Right to access: Request a copy of your personal data and information about processing
• Right to correction: Request correction of inaccurate or incomplete data
• Right to deletion: Request deletion of personal data in certain circumstances
• Right to object: Object to processing of personal data for direct marketing
• Right to restrict processing: Request limitation of data processing
• Right to data portability: Receive your data in a portable format

11.2 For DIFC residents, DIFC Data Protection Law No. 5 of 2020 provides similar rights, and you may lodge complaints with the DIFC Commissioner of Data Protection.

11.3 To exercise your UAE data protection rights, contact us at hello@theassetstandard.ae.

12.1 We use cookies and similar tracking technologies to collect and store information about your use of our website.

12.2 Types of cookies we use:

• Essential cookies: Required for the website to function (cannot be disabled)
• Analytics cookies: Help us understand how visitors use our website (e.g., Google Analytics)
• Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness
• Preference cookies: Remember your preferences and settings

12.3 You can control cookies through your browser settings. However, disabling certain cookies may affect website functionality.

12.4 We use CookieYes (ID: 2b9cbe91d07539e7ea536b5d0a0d7bf8) for cookie consent management.

13.1 Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children.

13.2 If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.

13.3 If you believe we have collected data from a child, please contact us immediately at hello@theassetstandard.ae.

14.1 We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

14.2 We will notify you of material changes by:

• Posting the updated Policy on our website with a new "Last Updated" date
• Sending an email notification to registered users
• Displaying a notice on our website

14.3 Your continued use of our services after changes to this Policy constitutes acceptance of the updated Policy.

14.4 We encourage you to review this Policy periodically to stay informed about how we protect your data.