This Privacy Policy explains how HEMZO Real Estate Brokerage LLC ("HEMZO", "we", "us", "our") collects, uses, discloses, retains, and protects your personal data. We are committed to safeguarding your privacy and complying with applicable UAE data protection laws, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations.

1. Data Controller

HEMZO Real Estate Brokerage LLC, registered in Abu Dhabi, United Arab Emirates, is the data controller responsible for your personal data processed through this website and our advisory services. Our RERA broker registration number is available upon request.

2. Personal Data We Collect

We collect and process the following categories of personal data:

• Identification data: full name, nationality, Emirates ID / passport details (where required for transaction processing), date of birth.
• Contact data: email address, telephone number, postal address, preferred contact method.
• Property preference data: desired location, property type, budget range, investment objectives, and timeline.
• Financial qualification data: proof of funds, mortgage pre-approval status, source of funds declarations (collected solely for compliance and to tailor our advisory).
• Transaction data: records of viewings attended, offers made, contracts executed, and commission paid.
• Technical data: IP address, browser type, pages visited, and usage analytics collected via cookies (see Section 7 below).
• Marketing data: your preferences in receiving marketing communications and your consent status.

3. How We Use Your Data

We process your personal data for the following purposes, each grounded in a lawful basis under the PDPL:

• Service delivery: responding to enquiries, arranging viewings, conducting due diligence, and facilitating property transactions.
• Contractual performance: executing brokerage agreements and fulfilling our obligations to buyers, sellers, landlords, and developers.
• Legal and regulatory compliance: meeting obligations under RERA regulations, UAE AML/CFT laws, and reporting requirements to government authorities.
• Marketing communications: sharing new listings, market reports, and event invitations — only with your explicit, opt-in consent, which you may withdraw at any time.
• Service improvement: analysing website usage and client feedback to enhance our advisory offering.
• Security and fraud prevention: detecting and preventing fraudulent enquiries, identity verification, and protecting our clients and staff.

4. Legal Bases for Processing

Our processing of your personal data relies on one or more of the following lawful bases:

• Your consent, freely given, specific, and withdrawable at any time (e.g. for marketing).
• Performance of a contract to which you are a party (e.g. executing a brokerage mandate).
• Compliance with a legal obligation under UAE law (e.g. AML record-keeping).
• Our legitimate interests as a brokerage, balanced against your rights — e.g. maintaining client records for after-sales support.

5. Sharing with Third Parties

We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and under appropriate confidentiality obligations:

• Property developers: to register off-plan interest, secure allocations, and process sales agreements.
• Banks and mortgage providers: where you instruct us to facilitate financing.
• Government authorities: the Department of Municipalities and Transport (DMT), Abu Dhabi Real Estate Centre (ADREC), RERA, the Financial Intelligence Unit, and other bodies as required by UAE law.
• Professional advisors: lawyers, valuers, and property managers engaged to support your transaction, subject to your instruction.
• Service providers: hosting, email delivery, and analytics providers acting as data processors under written agreement.

We do not sell your personal data to any third party. We will only disclose data where required by law or where you have given your explicit consent.

6. Data Retention

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected, including compliance with legal obligations:

• Enquiry data is retained for 24 months from last contact unless you request earlier deletion.
• Transaction records are retained for the period mandated by UAE law (typically a minimum of 5 years for AML compliance).
• Marketing consent records are retained until you withdraw consent, after which we cease processing and delete associated data within 30 days.

7. Cookie Policy

This website uses cookies and similar technologies for the following purposes:

• Strictly necessary cookies: essential for the website to function (e.g. remembering your mobile menu state). These cannot be disabled.
• Analytics cookies: help us understand how visitors use the site so we can improve it. These are set only with your consent.
• Preference cookies: remember your settings (e.g. font size, dark mode if implemented in future).

You can manage or withdraw cookie consent via your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Please note that disabling strictly necessary cookies may affect site functionality.

8. Your Rights Under the PDPL

As a data subject under UAE Federal Decree-Law No. 45 of 2021, you have the following rights:

• The right to be informed about how we use your data (this policy).
• The right of access to your personal data and a copy of it.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure ("right to be forgotten"), subject to legal retention obligations.
• The right to restrict or object to processing, including for marketing.
• The right to data portability — receiving your data in a structured, machine-readable format.
• The right to withdraw consent at any time without affecting the lawfulness of prior processing.
• The right to lodge a complaint with the UAE Data Office or the relevant competent authority.

To exercise any of these rights, contact us using the details in Section 10 below. We will respond within 30 days.

9. International Transfers

Your personal data is primarily stored and processed within the UAE. Where a transfer to a jurisdiction outside the UAE is necessary (for example, to a cloud service provider's data centre), we will ensure the transfer complies with the PDPL's cross-border transfer requirements and that appropriate safeguards are in place.

10. Data Security

We implement organisational and technical measures to protect your personal data against unauthorised access, alteration, disclosure, or loss. These include encrypted transmission (TLS), access controls limited to authorised personnel, regular staff training, and periodic security reviews. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

Our website and services are directed to individuals aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates the most recent revision. We encourage you to review this policy periodically. Material changes will be highlighted on our website.

13. Contact — Data Protection Inquiries

If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to lodge a complaint about how we handle your personal data, please contact our Data Protection Officer:

You also have the right to lodge a complaint with the UAE Data Office or the relevant competent authority if you believe our processing of your personal data infringes applicable law.