Privacy Policy

Luxury Located Real Estate is the controller of the personal data described here: we decide why it is held and what is done with it. We are a real estate brokerage operating in Dubai, United Arab Emirates, and we are regulated as a brokerage by the Dubai Land Department and RERA.

Everything in this policy is written against UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and against the GDPR standard where a visitor is in the EU or the UK. Where the two differ we apply whichever gives you more.

Luxury Located Real Estate L.L.C, Dubai Department of Economy and Tourism trade licence 1313183, RERA ORN 41064. The registered office on the licence is stated in our terms.

We collect the information you provide in forms, account preferences and the visit information described below. Public previews remain available without registration. Full property details and documents require a verified account and an explicit agreement to share future signed-in property activity with your adviser.

Enquiries, viewing requests and the sell form

The contact form and the seller enquiry form take your name, email address, phone number and your message, plus which property you were looking at and whether you want to view it in person or virtually. We use it to answer you and to arrange viewings, and it is recorded as a lead in our CRM so that whoever picks it up can see the history.

Optional OpenAI / ChatGPT advertising measurement

With your separate, optional consent, we use OpenAI's measurement pixel and Conversions API to understand which ChatGPT ads lead to page visits and genuine enquiries. This choice is separate from Google Analytics, Meta measurement and contacting us. Before consent, the OpenAI SDK does not load and we do not read its advertising cookies.

After consent, OpenAI receives page views, ad and browser identifiers and successful enquiry events. Automatic matching may detect contact information on the page and hash it in your browser. Our server may send SHA-256 hashes of the email address and phone number supplied with a successful enquiry, along with the public page address and the same event ID for deduplication. Hashing does not make this information anonymous. We do not send enquiry messages, adviser notes, or property budgets, and request opt-out from future user-level personalization for the events we send.

The pixel's cookies and withdrawal control are described in our cookie notice. You can withdraw for future browser measurement there at any time. Events collected with consent may be retried server-side for up to seven days. Contact us about earlier data or deletion requests. This does not affect the service you receive.

Optional Meta advertising measurement

The Marsa Al Saadiyat, Wadeem Gardens and Bay Estate enquiry forms on this website offer a separate, optional checkbox for Meta advertising measurement. It is off by default and is not required to contact us. If you agree, Treasury CRM can send Meta your enquiry and later sales milestones, such as qualification or a completed sale. Contact details are hashed before transfer for matching; hashing does not make them anonymous. We may also send the page address, campaign tags, browser type and Meta click or browser identifiers if they are available. We do not send enquiry messages or rejection notes to Meta.

No Meta pixel or advertising cookie is set by these forms. Existing Meta identifiers are read only after you choose this option. To withdraw consent for future CRM updates, contact us using the details below and ask us to stop Meta advertising measurement. Withdrawal does not undo processing that already took place.

Facebook and Instagram lead forms

When you send an enquiry through a lead form in one of our Facebook or Instagram ads, for example for Bay Estate, Meta passes us what you entered in that form: your name, email address and phone number, any answers the form asks for, and the ad and form it came from. We record it as a lead in Treasury CRM and use it to answer you. An adviser may message you on WhatsApp from +971 58 595 5857, or call you, about that enquiry.

To measure our ads, Treasury CRM then tells Meta how that enquiry progresses, using Meta's own lead ID through the Conversions API: when we receive it, and stages such as qualified, meeting booked, lost or not reachable, and a completed purchase with its recorded value. We do not send your messages or our notes. To ask us to stop these updates for your enquiry, contact us using the details below.

Project enquiries and your free client account

Marsa Al Saadiyat, Wadeem Gardens and Bay Estate enquiries are saved immediately. We also email a private, single-use link to activate or access your free Luxury Located client account. The link expires after 30 minutes. An account is activated only after you confirm through that link. We do not use a typed email address alone as proof of identity.

Full property details and documents require you to agree separately to share future signed-in property and project views, brochure requests, payment-plan views, search actions and saves with your Luxury Located adviser in Treasury CRM while signed in to a verified account. Search text, private account pages and earlier anonymous browsing are excluded. This choice is separate from contact consent and Meta advertising measurement. Turn it off in My account to stop future collection against your identity and queued activity transfers. This also closes access to full property details and documents; public previews, your account and existing enquiries remain available. Previously shared activity stays with the enquiry record; use Your Data Rights to request its removal.

The concierge widget

The concierge takes your name, email and phone number along with what you told it about the market you are looking at, your intent and your budget range. Alongside it we record the city and country our hosting provider infers from your connection, so an enquiry at two in the morning is understood as somebody in another time zone rather than an odd hour. We do not store your IP address with it.

Newsletter

The newsletter takes your email address and nothing else. It is used to send market updates and off-market opportunities. Every email carries an unsubscribe link, and unsubscribing removes the address.

Registered accounts

Registering takes your name, email address, phone number, whether you are buying, selling or working as an agent. New client registration uses a private email verification link, with no password required. Existing password sign-ins remain available; stored passwords are hashed. If you register as an agent we also hold the broker card or licence document you upload and whether it has been approved.

Saved properties and saved searches

Saved properties and saved searches are linked to your account. A saved search stores the criteria you chose and how often you want to hear about matches, and it emails you when new stock matches. Alert emails contain a one-click unsubscribe link that works without signing in.

Brochures and gated documents

Full property details and documents require a verified signed-in account with activity sharing enabled. Submitting an enquiry alone does not unlock them. When you deliberately request full details, view a brochure or request a download, we record the property, action and time with your enquiry and notify your Luxury Located adviser. Document access is delivered through short-lived links after this check.

Calculators

The mortgage, yield, cost-of-buying, payment-plan, rent-versus-buy and Golden Visa tools run in your browser. The numbers you type into them are not sent to us and are not stored.

Anti-fraud and rate limiting

Your IP address is read at the moment you submit a form and passed to Cloudflare Turnstile, which decides whether the submission came from a human. It is also used, in memory for short-term rate limits. Account email requests additionally store a keyed hash of the connection address for abuse prevention. The raw address is not stored in that record. Expired account-link records are removed by the daily maintenance job once they are more than seven days old.

For property enquiry, launch enquiry and valuation forms, we also keep a keyed hash of the connection address and normalized contact details to flag enquiries from the same network with different details within 30 days. We do not store the raw address in the enquiry record. Our team receives an internal alert; a shared network is not treated as proof that two enquiries are from the same person and does not merge or block contacts. This check is separate from optional visit analytics. The daily maintenance job removes these fingerprints after 30 days; any resulting enquiry note remains with the CRM record.

Visit analytics

A cookie named ll_vid holds a random identifier, generated by us, so that the pages you look at on one visit can be counted as one visit rather than as strangers. It contains nothing but that identifier. It is HTTP-only, so no script on the page can read it, and it is never sent to another company.

Against that identifier we record which pages were viewed and when, what kind of page each one was, the site you arrived from, and any campaign tags in the link you followed. It is stored in our website database. With the required property-access activity agreement enabled for a verified, signed-in client account, eligible future events are also sent to Treasury CRM with the linked enquiry identifier. The visitor cookie itself is not sent to Treasury.

Submitting an enquiry does not attach past anonymous visits to your identity. A new visitor identifier is used when signing in, signing out or changing activity consent. Identified visit records are kept with the enquiry. The retention target for anonymous visits is 180 days; automated enforcement is currently pending retention review. You can turn off adviser activity sharing in My account and request deletion through Your Data Rights. Public previews, your account and enquiry features remain available; full property details and documents become locked.

Cookies

The complete list, including the two browser-storage keys that never leave your machine, is on the Cookie Notice. In short: a sign-in session cookie, a CSRF cookie, a return-URL cookie, three preference cookies for language, currency and area unit, and the visit-analytics cookie described above. Optional advertising measurement has its own separate consent controls and is described above.

We are building an internal system that reads public posts about buying property in Dubai and identifies people who appear to be in the market. It is not processing real data yet: this section is published before it is switched on, deliberately, so that nobody is described by a system that was never disclosed. Once it starts, this is how it will work. If you have posted publicly asking about buying in Dubai, this section is about you, and it is the part you should read closely.

What it looks at, and what it will not touch

It reads only material that is published to the open web and visible to anyone without logging in: public forum threads, public posts on social platforms, and public comment threads. It does not read private messages. It does not join or read closed groups, private communities or members-only forums. It does not use any credential, any logged-in session, or any platform data behind authentication, and it does not attempt to circumvent a platform's access controls. If a post is not visible to a member of the public who is not signed in, it is out of scope.

We do not buy personal data from data brokers or lead vendors for this.

What is held

• The public handle or display name the post was made under, and a link to the post.
• The platform and the date it was posted.
• The text of the public post itself, or the part of it relevant to a property intent.
• What we infer from it: that the person appears to be looking to buy, and where available an approximate budget band, an area or project of interest, and a rough timeline.
• Contact details only where the person published them themselves in that same public post.

We do not attempt to attach a real-world identity, an address, a phone number or an email address to a public handle that did not publish one. We do not profile anybody for anything other than whether they are currently interested in buying property.

Why we are allowed to do it

Our lawful basis is legitimate interest: identifying people who have publicly said they are looking to buy in Dubai so that a brokerage can offer to help them. We consider that interest is not overridden by your rights here because the source material is already public, the subject matter is commercial rather than sensitive, the volume held per person is small, and we have made objecting easy and free. We have carried out this balancing exercise, and you can ask us for it.

We do not process special categories of data (health, religion, political opinion, and the like) in this system, and if such material appears in a post it is discarded rather than stored.

How long it is kept

A signal that never turns into a qualified lead is kept for a maximum of 180 days from the date of the post, and is then hard deleted. Hard deletion means the row is removed, not flagged: it does not survive as an archived record. If a signal qualifies and the person becomes a lead, it is retained under the CRM retention rules in the section below instead.

Who else sees it

Qualified leads are passed into Treasury CRM, which processes them on our instructions and on our behalf as our processor. It does not use them for its own purposes. Nothing from this system is sold, rented or shared with any other brokerage, advertiser or lead marketplace.

How to make it stop

Email info@luxurylocated.com or use Your Data Rights, tell us the handle or the link to the post, and we will delete what we hold and add the handle to a suppression list so it is not picked up again. You do not have to give a reason, you do not have to prove anything beyond enough to identify the record, and it costs nothing. If you contact us to object, we stop first and correspond afterwards.

We do not sell personal data. We do not share it with other brokerages. The only third parties involved are the ones that run the machinery:

We also disclose personal data where the law requires it, for example to the Dubai Land Department, RERA, a tax authority or a court, and where it is necessary to establish or defend a legal claim.

Our hosting, database and email providers operate infrastructure outside the United Arab Emirates, so your data is processed outside the UAE. The application server that handles form submissions runs in Vercel's United States East region, and pages and media are served from Vercel's and Cloudflare's global edge networks, which means a request from Europe is normally answered from a European edge location. Where processing happens outside the UAE we rely on the providers' standard contractual protections and on their own compliance frameworks. You can ask us which provider holds what.

Whether or not you have ever used this website, you can ask us to:

• tell you what we hold about you and where it came from;
• give you a copy of it;
• correct it if it is wrong;
• delete it;
• stop processing it, including stopping the public-post signal work described above;
• stop sending you marketing, at any time, with no reason needed;
• withdraw a consent you previously gave, without that affecting what was lawful before you withdrew it.

The route is Your Data Rights, or simply email info@luxurylocated.com. We respond within 30 days. We may ask you for enough information to be sure the request is really yours, because handing your file to somebody else would be the worse failure. There is no charge.

If you are not satisfied with how we handled it, you can complain to the UAE Data Office, and if you are in the EU or the UK, to your local supervisory authority.

Passwords are stored hashed, never in readable form. Access to the CRM is limited by role, so an agent sees their own leads rather than everybody's. Traffic is encrypted in transit. Public forms are protected by a bot check and by rate limits. No system is perfect, and we will tell you and the regulator if a breach affecting you occurs.

This site is for adults buying and selling property. We do not knowingly collect data about anyone under 18, and we delete it if we find it.

The date at the top is when this text last changed materially. If we ever start doing something with your data that this page does not describe, this page changes before that starts, not after.