Privacy Policy

Luxury Located Real Estate is the controller of the personal data described here: we decide why it is held and what is done with it. We are a real estate brokerage operating in Dubai, United Arab Emirates, and we are regulated as a brokerage by the Dubai Land Department and RERA.

Everything in this policy is written against UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and against the GDPR standard where a visitor is in the EU or the UK. Where the two differ we apply whichever gives you more.

Our trade licence number, RERA ORN and registered office address are available on request: write to info@luxurylocated.com and we will send them. They will be published on this page once confirmed. Data protection questions sent to that address reach the person responsible for them.

Nothing here is collected quietly. Every item below arrives because you typed it into a form, clicked a switch, or signed in.

Enquiries, viewing requests and the sell form

The contact form and the seller enquiry form take your name, email address, phone number and your message, plus which property you were looking at and whether you want to view it in person or virtually. We use it to answer you and to arrange viewings, and it is recorded as a lead in our CRM so that whoever picks it up can see the history.

The concierge widget

The concierge takes your name, email and phone number along with what you told it about the market you are looking at, your intent and your budget range. Alongside it we record the city and country our hosting provider infers from your connection, so an enquiry at two in the morning is understood as somebody in another time zone rather than an odd hour. We do not store your IP address with it.

Newsletter

The newsletter takes your email address and nothing else. It is used to send market updates and off-market opportunities. Every email carries an unsubscribe link, and unsubscribing removes the address.

Registered accounts

Registering takes your name, email address, phone number, whether you are buying, selling or working as an agent, and a password. The password is stored only as a hash, so nobody here can read it. If you register as an agent we also hold the broker card or licence document you upload and whether it has been approved.

Saved properties and saved searches

Saved properties and saved searches are linked to your account. A saved search stores the criteria you chose and how often you want to hear about matches, and it emails you when new stock matches. Alert emails contain a one-click unsubscribe link that works without signing in.

Brochures and gated documents

Developer brochures, floor plans and project documents require an account. That is the trade: the material is free, and in exchange we know who we sent it to. We do not currently keep a per-file record of which document you opened and when.

Calculators

The mortgage, yield, cost-of-buying, payment-plan, rent-versus-buy and Golden Visa tools run in your browser. The numbers you type into them are not sent to us and are not stored.

Anti-fraud and rate limiting

Your IP address is read at the moment you submit a form and passed to Cloudflare Turnstile, which decides whether the submission came from a human. It is also used, in memory only and for less than a minute, to rate limit automated harvesting of the catalogue. Your IP address is not written to our database in either case.

Cookies

The complete list, including the two browser-storage keys that never leave your machine, is on the Cookie Notice. In short: a sign-in session cookie, a CSRF cookie, a return-URL cookie, and three preference cookies for language, currency and area unit. There is no advertising cookie and no cross-site tracker.

We are building an internal system that reads public posts about buying property in Dubai and identifies people who appear to be in the market. It is not processing real data yet: this section is published before it is switched on, deliberately, so that nobody is described by a system that was never disclosed. Once it starts, this is how it will work. If you have posted publicly asking about buying in Dubai, this section is about you, and it is the part you should read closely.

What it looks at, and what it will not touch

It reads only material that is published to the open web and visible to anyone without logging in: public forum threads, public posts on social platforms, and public comment threads. It does not read private messages. It does not join or read closed groups, private communities or members-only forums. It does not use any credential, any logged-in session, or any platform data behind authentication, and it does not attempt to circumvent a platform's access controls. If a post is not visible to a member of the public who is not signed in, it is out of scope.

We do not buy personal data from data brokers or lead vendors for this.

What is held

• The public handle or display name the post was made under, and a link to the post.
• The platform and the date it was posted.
• The text of the public post itself, or the part of it relevant to a property intent.
• What we infer from it: that the person appears to be looking to buy, and where available an approximate budget band, an area or project of interest, and a rough timeline.
• Contact details only where the person published them themselves in that same public post.

We do not attempt to attach a real-world identity, an address, a phone number or an email address to a public handle that did not publish one. We do not profile anybody for anything other than whether they are currently interested in buying property.

Why we are allowed to do it

Our lawful basis is legitimate interest: identifying people who have publicly said they are looking to buy in Dubai so that a brokerage can offer to help them. We consider that interest is not overridden by your rights here because the source material is already public, the subject matter is commercial rather than sensitive, the volume held per person is small, and we have made objecting easy and free. We have carried out this balancing exercise, and you can ask us for it.

We do not process special categories of data (health, religion, political opinion, and the like) in this system, and if such material appears in a post it is discarded rather than stored.

How long it is kept

A signal that never turns into a qualified lead is kept for a maximum of 180 days from the date of the post, and is then hard deleted. Hard deletion means the row is removed, not flagged: it does not survive as an archived record. If a signal qualifies and the person becomes a lead, it is retained under the CRM retention rules in the section below instead.

Who else sees it

Qualified leads are passed into Treasury CRM, which processes them on our instructions and on our behalf as our processor. It does not use them for its own purposes. Nothing from this system is sold, rented or shared with any other brokerage, advertiser or lead marketplace.

How to make it stop

Email info@luxurylocated.com or use Your Data Rights, tell us the handle or the link to the post, and we will delete what we hold and add the handle to a suppression list so it is not picked up again. You do not have to give a reason, you do not have to prove anything beyond enough to identify the record, and it costs nothing. If you contact us to object, we stop first and correspond afterwards.

We do not sell personal data. We do not share it with other brokerages. The only third parties involved are the ones that run the machinery:

We also disclose personal data where the law requires it, for example to the Dubai Land Department, RERA, a tax authority or a court, and where it is necessary to establish or defend a legal claim.

Our hosting, database and email providers operate infrastructure outside the United Arab Emirates, so your data is processed outside the UAE. The application server that handles form submissions runs in Vercel's United States East region, and pages and media are served from Vercel's and Cloudflare's global edge networks, which means a request from Europe is normally answered from a European edge location. Where processing happens outside the UAE we rely on the providers' standard contractual protections and on their own compliance frameworks. You can ask us which provider holds what.

Whether or not you have ever used this website, you can ask us to:

• tell you what we hold about you and where it came from;
• give you a copy of it;
• correct it if it is wrong;
• delete it;
• stop processing it, including stopping the public-post signal work described above;
• stop sending you marketing, at any time, with no reason needed;
• withdraw a consent you previously gave, without that affecting what was lawful before you withdrew it.

The route is Your Data Rights, or simply email info@luxurylocated.com. We respond within 30 days. We may ask you for enough information to be sure the request is really yours, because handing your file to somebody else would be the worse failure. There is no charge.

If you are not satisfied with how we handled it, you can complain to the UAE Data Office, and if you are in the EU or the UK, to your local supervisory authority.

Passwords are stored hashed, never in readable form. Access to the CRM is limited by role, so an agent sees their own leads rather than everybody's. Traffic is encrypted in transit. Public forms are protected by a bot check and by rate limits. No system is perfect, and we will tell you and the regulator if a breach affecting you occurs.

This site is for adults buying and selling property. We do not knowingly collect data about anyone under 18, and we delete it if we find it.

The date at the top is when this text last changed materially. If we ever start doing something with your data that this page does not describe, this page changes before that starts, not after.