Privacy Policy

Property Banana Tech FZ-LLC is a technology company registered in the United Arab Emirates.

• Legal name: Property Banana Tech FZ-LLC
• Licence: Dubai Development Authority (DDA) Licence No. 107305
• Registered address: in5 Tech, Dubai Internet City, Dubai, United Arab Emirates
• Website: propertybanana.com
• Contact for all enquiries, including data protection and requests to the Data Protection Officer: support@propertybanana.com

For the purposes of applicable data protection law, Property Banana acts as a Data Controller in respect of the personal data described in this Policy, except where we process data solely on the documented instructions of a partner brokerage, in which case we act as a Data Processor. Where we act as a Processor, the brokerage's own privacy notice will also apply to you.

Property Banana is established in the Dubai Development Authority free zone, which is a non-financial free zone. Our processing of personal data is therefore governed principally by:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), in force since 2 January 2022
• UAE Federal Decree-Law No. 44 of 2021, which established the UAE Data Office as the federal supervisory authority
• UAE Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, and Cabinet Decision No. 28 of 2023, in relation to electronic signatures and digital identity
• UAE Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes
• UAE Federal Law No. 15 of 2020 on Consumer Protection and Cabinet Decision No. 66 of 2023 (its Executive Regulations)
• Dubai real estate legislation, including Law No. 26 of 2007 regulating the relationship between landlords and tenants in the Emirate of Dubai (as amended by Law No. 33 of 2008) and the Ejari registration requirements administered by the Dubai Land Department

At the date of this Policy, the Executive Regulations contemplated by the PDPL have not been published as a discrete instrument in the UAE Official Gazette. The substantive obligations of the PDPL nevertheless apply, and we comply with them. We will update this Policy if and when the Executive Regulations are issued.

This Policy applies to everyone whose personal data we handle, including:

• Tenants and prospective tenants who search, book viewings, make offers, sign and pay through the Platform
• Landlords and property owners whose properties are listed on the Platform through a licensed brokerage
• Brokers, agents and staff of RERA-licensed brokerages who use the Platform
• Visitors to our website and users of our mobile applications
• People who contact us by email, telephone, WhatsApp or through our web forms

4.1 Identity and verification data

• Full name, date of birth, nationality and gender
• Emirates ID number and Emirates ID card data
• Passport and visa details, where required for a tenancy
• UAE PASS digital identity attributes returned to us when you authenticate (see section 6)
• Photograph or facial image, where included in an identity document
• Trade licence number and RERA / BRN registration number, for brokers and brokerages

4.2 Contact data

• Email address, UAE and international mobile numbers, and WhatsApp number
• Current and previous residential address

4.3 Tenancy and transaction data

• Properties you view, shortlist, book viewings for, or make offers on
• Offer terms, including proposed rent, payment schedule, duration and special conditions
• The tenancy contract and any addenda, and your electronic signature and signing audit trail
• Employment or income information, and supporting documents, where a landlord or brokerage requires them to assess an application
• Ejari registration data and the Ejari certificate
• Security deposit, agency fee and rent payment records

4.4 Payment data

• Payment amount, currency, date, status and reference
• The last four digits of a payment card, the card brand, and the issuing country

We do not store full payment card numbers, CVV codes or bank credentials. Card payments are processed by our payment service provider, which handles card data directly under its own PCI DSS-certified environment.

4.5 Property access and viewing data

• Viewing bookings, reschedules and cancellations
• Smart lock access codes or credentials issued to you, and the date and time they were issued, used, expired or revoked
• Entry and exit events recorded by a smart lock at a property you were authorised to view

Smart lock access logs are a security and safety record. They tell us that a credential was used at a given time. They are also used to resolve disputes about whether a viewing took place and to protect landlords against unauthorised access.

4.6 Technical and usage data

• IP address, device identifiers, device model, operating system and browser type
• App version, language and time zone settings
• Pages and screens viewed, features used, search filters applied, and time spent
• Approximate location derived from IP address, and precise device location only where you have granted permission
• Crash reports, error logs and diagnostic data

4.7 Communications data

• Messages you exchange with us or with a brokerage through the Platform
• Emails, WhatsApp messages and support tickets
• Notes recorded by our team about a query or complaint

We do not record telephone calls unless we tell you at the start of the call that we are doing so.

4.8 Sensitive personal data

We do not seek to collect sensitive personal data as defined by the PDPL, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, biometric data processed to uniquely identify you, or data concerning your sex life. Where a UAE identity document you upload happens to contain such information, we process it only to the minimum extent necessary to verify your identity and complete the tenancy, and we do not use it for any other purpose.

• Directly from you, when you register, complete a profile, upload a document, book a viewing, make an offer, sign a contract, make a payment or contact us
• From UAE PASS, when you choose to authenticate or sign using your UAE PASS digital identity
• From a RERA-licensed brokerage or landlord, when they list a property, add you to a transaction, or supply tenancy information
• From our service providers, such as our payment processor confirming that a payment succeeded, or our smart lock provider confirming that a door was opened
• From UAE government systems and integrations, including the Dubai Land Department and Ejari, in connection with registering a tenancy contract
• Automatically, through cookies and similar technologies when you use our website or apps (see section 11)

Property Banana is an approved UAE PASS Service Provider. UAE PASS is the national digital identity and digital signature solution of the United Arab Emirates.

When you choose to sign in, verify your identity or apply an electronic signature using UAE PASS:

• You are redirected to the UAE PASS application or website, which is operated by the relevant UAE government entity, not by us. We never see, receive or store your UAE PASS password, PIN or biometric data.
• You are shown the specific attributes we are requesting, and you decide whether to consent to their release.
• If you consent, UAE PASS returns a defined set of identity attributes to us, which may include your full name in English and Arabic, your Emirates ID number, your nationality, your date of birth, your registered mobile number and email address, and a unique UAE PASS identifier.
• Where you apply a UAE PASS electronic signature to a document, we receive and retain the signed document, the signature certificate information and an audit trail recording the identity of the signatory and the date and time of signing.

Your use of UAE PASS is also governed by the UAE PASS terms of use and privacy notice published by its operator. We recommend that you read them. We are responsible only for what we do with the attributes UAE PASS returns to us, which is described in this Policy.

Under the PDPL, consent is the default basis for processing, with defined exceptions where processing is necessary for other specified purposes. We set out below each purpose and the basis on which we rely.

We do not sell your personal data. We share it only as described below.

• Payment processing — to take and reconcile card and bank payments
• Cloud hosting, storage and backup — to run and protect the Platform
• Communications — to send email, SMS and WhatsApp messages
• Smart lock and access control — to issue and manage property access credentials
• Electronic signature and document management — to generate, sign and store tenancy documents
• Analytics, crash reporting and product monitoring
• Customer support tooling
• Professional advisers, including lawyers, auditors and accountants

A current list of our principal service providers is available on request from support@propertybanana.com.

Some of our service providers process or store personal data outside the United Arab Emirates. Where that happens, we transfer personal data outside the UAE only where one of the following applies, consistent with Articles 22 and 23 of the PDPL:

• the destination jurisdiction provides an adequate level of protection for personal data, or is subject to a bilateral or multilateral agreement to which the UAE is a party
• the transfer is made under a contract or binding instrument that obliges the recipient to apply protections equivalent to those required by the PDPL
• you have given your explicit consent to the transfer, and the transfer would not conflict with the public and security interests of the UAE
• the transfer is necessary to perform a contract with you, or to conclude or perform a contract in your interest
• the transfer is necessary to establish, exercise or defend a legal claim, or to protect the vital interests of a person

You may request further information about the safeguards applied to a specific transfer by contacting support@propertybanana.com.

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as we are required to keep it by law. Our current retention periods are:

• Account data: for the life of your account, and for 24 months after you close it or after your last activity, whichever is later
• Identity verification records: for the duration of any tenancy facilitated through the Platform and for 5 years afterwards
• Tenancy contracts, signature audit trails and Ejari records: for at least 5 years, and for up to 15 years where longer retention is required by UAE tax and real estate record-keeping rules
• Payment and financial records: for 5 years from the end of the relevant tax period, or longer where required for real estate related records
• Smart lock access logs: 12 months, unless retained longer in connection with an active dispute, investigation or claim
• Support communications: 24 months from the date the matter is closed
• Marketing consent records: for the duration of your consent and 24 months after it is withdrawn, so that we can evidence that we honoured your withdrawal
• Technical logs and analytics: 12 to 24 months, depending on the log type

When a retention period ends, we securely delete the data or irreversibly anonymise it so that it can no longer be linked to you. Where deletion is not immediately possible for technical reasons, for example within a backup, we isolate the data and delete it on the next backup cycle.

We use cookies and similar technologies on our website and comparable identifiers in our mobile applications. We group them as follows:

• Strictly necessary — required to operate the Platform, keep you signed in, route your requests and protect against fraud and abuse. These cannot be switched off.
• Functional — remember your preferences, such as language, saved searches and display settings.
• Analytics — help us understand how the Platform is used so we can improve it. These are set only with your consent.
• Marketing — used to measure and, where applicable, deliver advertising. These are set only with your consent.

When you first visit our website you will be shown a cookie banner that lets you accept or reject non-essential cookies. You can change your choice at any time through the cookie settings link in the website footer, and you can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent parts of the Platform from working.

We apply technical and organisational measures appropriate to the sensitivity of the data we hold. These include:

• Encryption of personal data in transit using TLS, and encryption at rest for stored data and documents
• Role-based access control, so that staff and partners can access only the data they need for their role
• Multi-factor authentication on administrative and privileged accounts
• Segregation of production data from development and testing environments
• Logging and monitoring of access to personal data
• Written data processing agreements and security obligations with our service providers
• Regular review of access rights, and prompt revocation on departure or change of role
• Backup and disaster recovery procedures

No system can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and for notifying us immediately at support@propertybanana.com if you believe your account has been accessed without your authorisation.

If a personal data breach occurs that would prejudice the privacy, confidentiality or security of your personal data, we will notify the UAE Data Office without undue delay, and in any event within 72 hours of becoming aware of the breach where feasible. Where the breach is likely to prejudice your rights, we will also notify you directly and tell you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

Subject to the conditions and exceptions in the PDPL, you have the following rights in relation to your personal data:

• Right to information — to be told how your personal data is processed, which this Policy provides
• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to have inaccurate or incomplete data corrected or completed
• Right to erasure — to have your personal data deleted, where we no longer have a lawful reason to keep it
• Right to restrict processing — to have processing limited in defined circumstances, for example while a dispute about accuracy is resolved
• Right to data portability — to receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transferred to another controller where technically feasible
• Right to object — to object to processing carried out for direct marketing, or to processing based on our legitimate interests
• Right to withdraw consent — to withdraw any consent you have given, at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal
• Rights in relation to automated processing — to object to a decision made solely by automated means that produces legal effects concerning you or similarly significantly affects you

To exercise any of these rights, email support@propertybanana.com. We may ask you to verify your identity before we act, to make sure we do not disclose your data to someone else. We will respond within 30 days of receiving a valid request. If your request is complex or you have made several requests, we may extend that period and will tell you if we do.

There is no charge for exercising your rights. We may charge a reasonable fee, or decline to act, if a request is manifestly unfounded or excessive, and we will explain our reasoning if we do.

Some rights are limited. For example, we cannot delete a tenancy contract or an Ejari registration record that we are legally required to retain, and we cannot delete data we need to establish or defend a legal claim.

We do not currently make decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you. Automated tools may be used to help order search results, flag suspicious activity for review, or prioritise support requests, but decisions with a material effect on you, such as whether a landlord accepts your offer, are made by people. If this changes, we will update this Policy and tell you about your rights before the change takes effect.

We will only send you marketing communications if you have opted in. Every marketing email and message will contain a clear way to unsubscribe, and you can also opt out at any time in your account settings or by emailing support@propertybanana.com. Opting out of marketing does not stop service messages about your account, viewings, contracts or payments.

The Platform is intended for adults. You must be at least 18 years old to create an account or enter into a tenancy through the Platform. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18 without appropriate authorisation, we will delete it promptly. If you believe a child has provided us with personal data, contact support@propertybanana.com.

The Platform may contain links to third-party websites, applications and services, including property portals, government portals and payment pages. We are not responsible for the privacy practices of those third parties. When you follow a link away from the Platform, you should read the privacy notice of the site or service you are visiting.

We may update this Policy from time to time to reflect changes to our services, our technology or the law. When we make a material change, we will update the "Last updated" date at the top of this Policy and give you reasonable advance notice by email or through the Platform before the change takes effect. Your continued use of the Platform after a change takes effect means you accept the updated Policy. Previous versions are available on request.

If you have a question about this Policy, or you wish to exercise a right, contact us first:

• Email: support@propertybanana.com
• Post: Data Protection Officer, Property Banana Tech FZ-LLC, in5 Tech, Dubai Internet City, Dubai, United Arab Emirates

We take complaints seriously and will try to resolve yours directly. If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office, the federal supervisory authority for personal data protection in the United Arab Emirates.