Privacy Policy

We collect and process only the personal data strictly required to deliver bespoke investment advisory, underwrite property acquisitions, and satisfy UAE statutory compliance obligations.

a) Information you provide directly:

• Identification & Contact Details: Full legal name, date of birth, passport copy, Emirates ID (for UAE residents), nationality, country of tax residence, primary residential address, contact email address, and direct telephone/WhatsApp numbers.
• Investor & Portfolio Criteria: Capital allocation budgets, target asset classes (off-plan developments, prime waterfront villas, high-yield commercial assets), yield profile requirements, financing/mortgage preferences, and expected exit horizons.
• Statutory Anti-Money Laundering (AML) & KYC Documentation: Source of funds declarations, bank account verification letters, proof of wealth documentation, and Politically Exposed Person (PEP) declarations required prior to contract submission.
• Advisory Inquiries & Communications: Detailed investment objectives submitted via our online enquiry forms, scheduled video consultations, WhatsApp dialogues, and written correspondence.

b) Information collected automatically through your use of the website:

• Device & Technical Telemetry: Anonymized Internet Protocol (IP) address, browser architecture, operating system, network provider, and hardware device identifiers.
• Navigation & Behavioral Analytics: Clickstream history, time spent on specific property analyses, referring search engines, pagination behavior, and user engagement across interactive portal features.
• Security & Session Cookies: Necessary cryptographic tokens validating session integrity and safeguarding administrative access (see Section 6).

c) Information received from authorized third parties:

• Official Regulatory Registries: Property verification and title deed status confirmation through Dubai Land Department (DLD) and RERA public registers.
• Sanctions & Compliance Screening Platforms: Authorized databases (such as World-Check and UAE FIU systems) utilized to perform mandatory international sanctions and AML screening.
• Authorized Master Developer Partners: Transaction progress updates and unit allocation files received from licensed UAE developers (e.g., Emaar, Nakheel, Meraas, Sobha, Aldar).

RealTerra processes personal data strictly for defined advisory, commercial, and regulatory purposes:

• Underwriting Tailored Property Recommendations: Formulating bespoke portfolio strategies, calculating projected net rental yields, and identifying optimal market entry windows based on your declared investment parameters.
• Facilitating Real Estate Transactions: Preparing Unified Real Estate Contracts (Forms A, B, and F), drafting reservation agreements, and coordinating with master developers, escrow agents, and the Dubai Land Department (DLD).
• Executing Statutory KYC & AML Due Diligence: Performing mandatory client identity verification, UBO screening, and compliance reporting in accordance with UAE Federal Decree-Law No. 20 of 2018 on AML/CFT.
• Delivering Curated Market Intelligence: Distributing research reports, macro-economic property bulletins, and exclusive off-plan allocation notices where you have given affirmative consent.
• Protecting Portal Security & System Integrity: Monitoring server telemetry, mitigating cross-site scripting risks, preventing fraudulent inquiries, and ensuring continuous platform availability.
• Legal Compliance & Dispute Resolution: Preserving evidence required to assert or defend legal rights before UAE judicial courts, the Land Dispute Center, or arbitration bodies.

In strict compliance with Articles 4, 5, and 6 of UAE Federal Decree-Law No. 45 of 2021 (PDPL), RealTerra relies upon the following lawful grounds to process personal data:

a) Performance of an Advisory or Brokerage Contract (Article 5(1)):

Processing is indispensable to negotiate terms, prepare brokerage agreements, liaise with master developers, and execute property acquisition contracts at your direct request.

b) Compliance with Mandatory UAE Statutory Obligations (Article 5(2)):

Processing is compulsory to discharge statutory obligations under UAE Federal Law No. 20 of 2018 on Anti-Money Laundering, Cabinet Decision No. 10 of 2019, RERA Brokerage Bylaws, and Dubai Land Department administrative circulars.

c) Legitimate Interests (Article 5(5)):

Processing necessary to preserve network security, prevent cyber-fraud, optimize analytical models, and maintain operational efficiency, balanced against the fundamental rights of data subjects.

d) Explicit, Unbundled Consent (Article 6):

Processing for direct marketing updates, subscription newsletters, and discretionary analytics cookies is grounded in your clear, affirmative consent.

Confirmation of How Website and Marketing Consent is Collected:

• Web Inquiry & Advisory Forms: Every submission point across realterra.ae (including /contact, project inquiry modals, and portfolio review forms) includes an unbundled consent declaration: "By submitting this inquiry, you confirm that you have read and accepted our Privacy Policy and consent to receiving tailored property insights via email, phone, or WhatsApp." Consent checkmarks are never pre-selected.
• Research Reports & Guide Downloads: Downloading investor guides requires affirmative submission of contact credentials with distinct notice that market intelligence will be provided. Every correspondence includes an instantaneous one-click unsubscribe mechanism.
• Direct Inbound WhatsApp Consultations: Inbound dialogues via WhatsApp (wa.me) are initiated solely by voluntary user choice. Users may discontinue communication at any time by messaging "STOP".
• Revocation of Consent: You may withdraw your consent at any time without charge by writing to operations@realterra.ae. Withdrawal takes effect immediately and does not impair the validity of processing conducted prior to revocation.

RealTerra does not sell, trade, or monetize personal data under any circumstances. Personal information is disclosed solely to authorized recipients on a need-to-know basis:

a) Authorized Commercial & Regulatory Recipients:

• Licensed UAE Master Developers & Landlords: Selected developers (such as Emaar, Nakheel, Aldar, Meraas, DAMAC, Sobha) involved in the specific acquisition you are pursuing.
• Government & Supervisory Authorities: Dubai Land Department (DLD), Real Estate Regulatory Agency (RERA), UAE Financial Intelligence Unit (FIU), and judicial courts where disclosure is required by law.
• Conveyancing & Fiduciary Partners: Escrow custodian banks, licensed conveyancing lawyers, and registered public notaries facilitating transaction closure.

b) International Service Providers & Cloud Infrastructure Vendors:

To deliver our high-performance digital services, RealTerra contracts with market-leading enterprise service providers whose infrastructure is located outside the UAE:

• Cloud Platform & Edge Hosting: Vercel Inc. (United States & Global Edge Network) — serverless application delivery with TLS 1.3 encryption in transit.
• Cloud Database & Storage: Supabase Inc. / Amazon Web Services (AWS) (Data Center Region: Frankfurt, Germany / Ireland, European Union; secondary backup: United States) — encrypted at rest utilizing AES-256.
• Enterprise Email & Workspace: Google Workspace / Google Ireland Limited (European Union & United States) — ISO 27001 and SOC 2 Type II certified corporate messaging.
• Client Communication & Messaging: Meta Platforms Ireland Limited / Meta Platforms Inc. (WhatsApp Business API; European Union & United States) — encrypted direct client messaging.
• Web Analytics Infrastructure: Google LLC (Google Analytics 4; United States & European Union) — privacy-compliant visitor telemetry with default IP masking.

c) Statutory International Transfer Safeguards (UAE PDPL Articles 22 & 23):

All cross-border data transfers outside the United Arab Emirates are executed in strict alignment with Chapter 5 of the PDPL:

• Adequate Jurisdictions: Transfers to the European Union and EEA countries rely on regulatory recognition of jurisdictions providing an adequate level of personal data protection.
• Standard Contractual Clauses (SCCs): For transfers to other countries (including the United States), RealTerra executes binding Data Processing Addenda (DPAs) incorporating standard contractual clauses, mandatory technical audits, TLS 1.3 transit encryption, and AES-256 encryption at rest.

Our website (realterra.ae) employs first-party cookies, secure session tokens, and verified third-party analytics technologies to guarantee security, improve user experience, and analyze portal engagement.

a) Cookie Classification & Technical Inventory:

• Strictly Necessary & Security Cookies (Essential):
• cms_session: Secure authentication token validating administrative access (HTTP-only, SameSite=Lax, Secure, duration: 7 days).
• Security & CSRF Tokens: Cryptographic tokens defending against cross-site request forgery during contact form submissions (duration: session-only).
• Cookie Preferences Token: Records your cookie consent choices and customization settings (duration: 12 months).

• Performance & Analytics Tools:
• Google Analytics 4 (GA4): Evaluates aggregate visitor volume, session duration, and project page popularity. RealTerra enforces IP masking so that no complete IP address is ever stored.
• Cookie _ga: Identifies unique visitors across sessions (duration: 2 years).
• Cookie _ga_<container-id>: Maintains persistent session telemetry (duration: 2 years).
• Vercel Web Analytics & Speed Insights: First-party diagnostic tools evaluating Core Web Vitals (LCP, INP, CLS) without setting tracking cookies or following users across third-party websites.

• Functional & Preference Storage:
• Local Storage Tokens: Preserves preferred price currency displays (AED, USD, EUR, GBP) and user property filter choices across navigation turns.

• Advertising & Attribution Tools (Active Only With Explicit Consent):
• Meta Pixel (Meta Platforms Inc.): Measures the efficacy of our sponsored educational articles and editorial campaigns on Instagram and Facebook.
• Cookie _fbp: Browser token used for campaign attribution and conversion auditing (duration: 90 days).
• Google Ads Conversion Tag (Google LLC): Evaluates conversion rates for high-intent search inquiries (duration: 90 days).

b) How to Manage and Disable Cookies:

You can manage or block non-essential cookies at any time via your browser settings:

• Google Chrome: Settings → Privacy and security → Third-party cookies
• Apple Safari: Preferences → Privacy → Prevent cross-site tracking
• Mozilla Firefox: Settings → Privacy & Security → Enhanced Tracking Protection
• Microsoft Edge: Settings → Cookies and site permissions

Please note that blocking strictly necessary cookies may disable interactive portal functionality and secure form submissions.

In strict compliance with Article 9 of UAE Federal Decree-Law No. 45 of 2021 and UAE AML statutes, RealTerra adheres to defined, transparent retention schedules. Personal data is never stored indefinitely.

a) Specific Retention Schedule:

• General Inquiries & Prospective Advisory Records: Retained for twenty-four (24) months from the date of the last recorded interaction, inquiry, or advisory session. Upon expiration, records are securely expunged or anonymized for statistical reporting.
• Completed Real Estate Transaction Records: Retained for five (5) years following title deed transfer and transaction closure, in accordance with RERA Brokerage regulations, the Dubai Commercial Code, and accounting audit mandates.
• Anti-Money Laundering (AML) & KYC Files: Retained for a mandatory statutory minimum of five (5) years following the completion of the transaction or termination of the business relationship, as required by Article 24 of UAE Cabinet Decision No. 10 of 2019.
• Newsletter & Market Research Subscribers: Retained continuously until the subscriber unsubscribes or requests deletion. Email suppression requests are processed within forty-eight (48) hours.
• Technical Server & Security Logs: Retained for one hundred and eighty (180) days for forensic cybersecurity investigations and denial-of-service prevention.

b) Cryptographic Destruction Standards:

Upon the expiry of the mandatory retention window, digital records are permanently wiped from active servers and cloud backups using NIST SP 800-88 compliant cryptographic erasure procedures.

RealTerra implements enterprise-grade technical, physical, and administrative safeguards designed to protect personal data against accidental loss, unauthorized destruction, alteration, or unlawful disclosure:

• Cryptographic Protections: All communication between your browser and our servers is secured via Transport Layer Security (TLS 1.3 with full HSTS enforcement). All databases, secondary backups, and cloud asset repositories are encrypted at rest using Advanced Encryption Standard (AES-256).
• Strict Least-Privilege Access Controls: Access to sensitive client data, financial proof-of-funds documents, and identity records is restricted strictly to designated compliance officers and certified investment directors, secured by mandatory Multi-Factor Authentication (MFA).
• Routine Vulnerability Testing & Code Audits: Automated static analysis, package dependency audits, and perimeter vulnerability assessments conducted regularly.
• Statutory Breach Notification Procedures: In the unlikely event of a security incident posing risks to your personal data, RealTerra maintains operational protocols to notify the UAE Data Office and impacted individuals within the statutory timeframes specified by the Executive Regulations of the PDPL.

Under Chapter 2 (Articles 13 through 18) of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, data subjects enjoy comprehensive legal rights:

• Right to Information & Access (Article 13): You have the right to obtain confirmation regarding whether your personal data is processed, the specific categories maintained, the purposes, and any international transfers.
• Right to Rectification (Article 14): You may request the prompt correction or completion of inaccurate, misleading, or outdated personal data held in our files.
• Right to Erasure / Right to be Forgotten (Article 15): You have the right to demand the erasure of your personal data when it is no longer necessary for the purposes collected, or where you have withdrawn consent—subject to statutory AML/RERA record-keeping exemptions.
• Right to Restrict Processing (Article 16): You may request the restriction of processing where you contest the accuracy of the data or where processing is under formal review.
• Right to Data Portability (Article 17): You are entitled to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another service provider where technically practicable.
• Right to Object to Automated Processing (Article 18): You have the right to object to automated decision-making or profiling. RealTerra does not utilize automated decision-making systems to determine advisory eligibility or contractual terms.

How to Exercise Your Statutory Rights:

To exercise any of the above rights, please transmit a formal written notice to our Operations & Data Protection Department:

Email: operations@realterra.ae

Subject: Formal Data Subject Rights Request (UAE PDPL)

Attention: Operations & Legal Compliance Department

Postal Address: Office C-50, Trade Centre 2, Dubai, Dubai, 000, Dubai

We will verify your identity before processing the request and issue a formal written determination within thirty (30) calendar days, as required by the PDPL Executive Regulations.

Right to Lodge a Regulatory Complaint:

If you believe that RealTerra has processed your personal data in contravention of UAE law, you have the statutory right to file a complaint with the UAE Data Office, the national regulatory authority created under Federal Decree-Law No. 44 of 2021.

Our website may feature hyperlinks to external web portals operated by licensed master developers (e.g., Emaar, Nakheel, Aldar, Sobha), financial institutions, or government entities (Dubai Land Department, RERA). These third-party websites operate under autonomous privacy policies. RealTerra assumes no legal liability for the content, privacy practices, or data management policies of external operators.

RealTerra's real estate advisory services, market intelligence publications, and investment advisory operations are targeted strictly at individuals who are at least eighteen (18) years of age. We do not knowingly solicit, collect, or store personal data concerning minors. If we discover that personal data regarding a minor has been submitted without verifiable parental or guardian authorization, we will permanently delete such information immediately.

RealTerra reviews and updates this Privacy Policy periodically to reflect emerging statutory requirements under the UAE PDPL, evolving RERA directives, and enhancements to our technology stack. Any material changes will be highlighted through a prominent notice on realterra.ae, and the "Last Updated" timestamp at the top of this document will be revised accordingly. Continued interaction with our services following the publication of changes constitutes acknowledgement of the updated terms.

For privacy-related questions, data subject access requests, or regulatory inquiries regarding our compliance posture, please contact our Operations & Compliance Desk: