Privacy Policy

This Privacy Policy explains how TODO — Registered legal entity name(“PropQ”, “we”, “us”) collects and uses personal data in connection with the PropQ service, in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and its implementing regulations.

For personal data of your account users (brokers and agency staff), we act as the data controller. For personal data of your clients and prospective investors that you enter into the Service (“Investor Data”), you are the controller and we act as your processor under our Data Processing Addendum.

We collect the following categories of personal data:

• Account & profile data — name, work email, company, job title, phone and WhatsApp number, RERA number, profile image, and preferences.
• Authentication data — a securely hashed password and session information.
• Content you create — property inputs, calculations, reports, message templates, and lead/CRM records you add.
• Investor Data you enter — names and contact details of prospective investors and clients, processed on your behalf.
• Billing data — plan, seats and invoicing details. Card payments, when enabled, are handled by our payment processor; we do not store full card numbers.
• Usage & technical data — log data, device/browser information, IP address, and essential cookies needed to run the Service (see our Cookie Policy).

Under the UAE PDPL we process personal data where we have a lawful basis. We use personal data to:

• provide, secure and operate the Service and your account (performance of contract);
• generate, store and share the Reports you create (performance of contract);
• process subscriptions, billing and VAT invoicing (contract / legal obligation);
• provide support and send service communications about your account (contract / legitimate interests);
• maintain security, prevent fraud and abuse, and keep audit logs (legitimate interests / legal obligation);
• improve and develop the Service using aggregated or de-identified data (legitimate interests);
• send marketing about PropQ where permitted — you can opt out at any time (consent / legitimate interests).

Where we rely on your consent, you may withdraw it at any time; this does not affect processing already carried out.

We do not sell your personal data. We share it only with:

• Service providers (processors) acting on our instructions — for example cloud hosting, database, email delivery, and payment processing — under contracts that require appropriate safeguards.
• Recipients you choose — for example when you send a report link or PDF to an investor, or message a client via WhatsApp using the link we generate.
• Authorities where required to comply with law, regulation, or a valid legal request, or to protect our rights, users, or the public.
• Successors in the event of a merger, acquisition or reorganisation, subject to this Policy.

We aim to host data in, or close to, the region. Where personal data is transferred outside the UAE — for example to a cloud provider’s data centre — we take steps required by the UAE PDPL to ensure an adequate level of protection, such as transferring to jurisdictions with an adequate-protection determination or putting appropriate contractual safeguards in place.

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, accounting and dispute-resolution obligations, after which it is deleted or anonymised. Investor Data is retained and deleted in line with your instructions under the Data Processing Addendum.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), hashed passwords, access controls, session cookies marked HTTP-only, and audit logging. No system is completely secure; if a personal data breach occurs that is likely to cause harm, we will notify the competent authority and affected individuals as required by the UAE PDPL.

Subject to the UAE PDPL and applicable exceptions, you have the right to:

• access the personal data we hold about you and request a copy;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict or object to certain processing;
• request that your data be transferred (portability);
• withdraw consent where processing is based on consent;
• lodge a complaint with the UAE Data Office.

To exercise your rights, contact privacy@propq.ae. If your request relates to Investor Data held on behalf of an agency, we may direct you to that agency as the controller. We may need to verify your identity before acting.

We use a small number of strictly necessary cookies and local storage to keep you signed in and to run the Service. We do not use advertising cookies. See our Cookie Policy for details.

The Service is a business tool intended for professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18.

We may update this Policy from time to time. We will post the updated version here with a new “last updated” date and, for material changes, provide additional notice.

For privacy questions or to exercise your rights, contact our data protection contact at privacy@propq.ae, or write to TODO — Registered legal entity name, TODO — Registered office address, Dubai, United Arab Emirates.