Privacy Policy

The controller responsible for the processing of your personal data is:

INANI REAL ESTATE LLC
Ahmad Building, Office G6, Hor Al Anz Area, Deira Dubai, United Arab Emirates
Represented by: Monika Kalicinska
Email: legal@inani-realestate.com
Phone: +971 54 375 8357

We are established in the United Arab Emirates. Our processing is therefore subject to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

Because we offer our services to people in the European Union and address them in their languages, the EU General Data Protection Regulation (GDPR) also applies when you are located in the EU (Art. 3(2) GDPR). We therefore describe every processing with its legal basis under the GDPR. Under the PDPL, processing is based on your consent or on one of the cases in which the PDPL permits processing without consent, in particular where it is necessary to take steps at your request before concluding a contract or to perform a contract with you, or to comply with legal obligations. Where the GDPR refers to our legitimate interests, we limit the processing under the PDPL to what is necessary to provide and secure the website and the service you request.

This website and the systems behind it (forms, customer database, email and notification services) are operated for us by Kuro Studio, Germany, as our processor under Art. 28 GDPR. Kuro Studio processes your data only on our instructions and under a data processing agreement, and uses the sub-processors listed in section "Recipients and service providers" for hosting, storage and email delivery.

When you open this website, your browser automatically sends technical data to our hosting provider: IP address, date and time of the request, requested page, referrer URL, browser type and version, operating system and device information.

Purpose: delivering the website, ensuring its stability and security, and detecting and defending against attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure and functioning website.

Retention: server logs are kept by the hosting provider for a limited period (at most 30 days) and then deleted, unless an incident requires longer retention to clarify it.

We do not combine this data with other data sources.

We use cookies and comparable technologies (local storage, session storage) only as far as they are strictly necessary to provide this website, or with your consent.

Strictly necessary storage (for example your cookie choice or a login session) is based on § 25(2) of the German TDDDG and comparable national rules implementing Art. 5(3) of the ePrivacy Directive, and on Art. 6(1)(f) GDPR.

Functional, analytics and marketing technologies are only loaded after you have given your consent in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Until then, these scripts are not loaded at all. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page; a withdrawal takes effect for the future.

The following technologies can be used on this website:

With your consent we use analytics and advertising services to understand how our website is used and to measure and optimise our advertising campaigns. The services used are listed in the table above and under "Recipients and service providers".

Data processed: pseudonymous online identifiers, IP address (shortened where the service supports it), device and browser information, pages visited, interactions (for example submitting a form, without its content), referrer and campaign parameters such as the advertising click ID.

Google Tag Manager is only loaded after you consent to analytics or marketing. It then loads the Google services listed above.

Google Analytics and Google Ads: Google Consent Mode passes your choice on to Google: analytics storage is only granted with analytics consent, advertising storage and ad personalisation only with marketing consent.

Advertising pixels of social networks (see the table above) are only loaded after marketing consent. They allow the network to link your visit with your user account there if you are logged in. For the collection and transmission of the data to the network we are jointly responsible with it (Art. 26 GDPR); the network is responsible for the further processing. You can exercise your rights against us or against the network.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via "Cookie settings".

Retention: see the storage periods in the table above; data stored by the providers is kept according to their policies.

Our market pages can show an interactive map whose map tiles are delivered by CARTO. Loading the tiles transmits your IP address and technical request data to CARTO, including to servers in the USA. The map is therefore only loaded after you have allowed functional technologies in the cookie banner or clicked "Load map"; until then a static image is shown.

Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG; for the transfer to the USA Art. 49(1)(a) GDPR.

Our forms are protected by Cloudflare Turnstile. When a form is loaded, Turnstile checks technical signals of your browser (for example IP address, browser characteristics and interaction signals) to distinguish people from automated programs. Turnstile does not use advertising cookies and does not show image puzzles.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms, systems and staff against spam, fraud and automated abuse. As this check is necessary to send the form you request, it is not subject to consent.

If you contact us via a contact form, email, phone or a messenger, we process the details you provide: name, email address, phone number, your message and, where you provide them, further details about your request. We also store the date and source of your request and a record that you asked us to contact you.

Purpose: answering your request and, where relevant, preparing and performing a contract.

Legal basis: Art. 6(1)(b) GDPR where your request aims at concluding or performing a contract; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering requests addressed to us.

Retention: we keep your request as long as it is needed to handle it and any resulting business relationship. We then delete it, unless statutory retention obligations (for example commercial and tax law) require us to keep it longer.

If you ask for information about a property or project or book a consultation, we process your name, contact details, the project or property concerned, your answers in the consultation questionnaire (for example budget range, investment goal, timing and preferred markets) and the campaign through which you reached us (for example campaign parameters of an advertisement). The questionnaire answers are stored temporarily in your browser's session storage until you submit or close the page, so that you do not lose them while navigating.

Purpose: answering your inquiry, advising you and preparing a possible purchase.

Legal basis: Art. 6(1)(b) GDPR (steps at your request before a contract). Recording the campaign through which you contacted us is based on Art. 6(1)(f) GDPR, our legitimate interest in understanding which of our channels lead to inquiries; it contains no data from third-party cookies.

Marketing: you only receive newsletters or market updates if you actively opt in with a separate checkbox, which we confirm by email (double opt-in).

Retention: as described under "Contact requests".

If you request a download (for example a brochure or guide), we process your email address and the further details requested in the form, send you a confirmation email with the download link and record that you received the document. Optional checkboxes for the newsletter or for a personal consultation are not pre-selected; we only contact you for these purposes if you tick them.

Legal basis: Art. 6(1)(b) GDPR for sending the document you requested; Art. 6(1)(a) GDPR for the optional consents.

Retention: as described under "Contact requests"; consents until you withdraw them.

If you register for an event, we process your name, contact details, the event and date you selected, your answers to the registration questions, your attendance and, where offered, your consents. We send you a confirmation email, calendar invitation and event-related updates.

Legal basis: Art. 6(1)(b) GDPR for the registration and event organisation; Art. 6(1)(a) GDPR for optional marketing consents, which we confirm by email (double opt-in).

Retention: registration data is kept as long as needed for the event and its follow-up, and then deleted unless a business relationship results or statutory retention obligations apply.

If you subscribe to our newsletter, we process your email address and, if provided, your name and language. After you sign up, we send you an email asking you to confirm your subscription (double opt-in). We only send newsletters after this confirmation and store the time of sign-up and confirmation as proof of your consent.

Legal basis: Art. 6(1)(a) GDPR.

Withdrawal: you can unsubscribe at any time via the link in every newsletter or by writing to us. We then stop sending newsletters and keep only a record of your consent and its withdrawal, so that we can prove it and do not send you newsletters again (Art. 6(1)(c) and (f) GDPR).

If you submit a lead form in one of our advertisements on Facebook, Instagram or Google, the platform passes the details you entered (usually name, email address, phone number and your answers) to us together with information about the campaign and form. The platform processes this data as its own controller; the form tells you what is shared with us.

Purpose and legal basis: answering your request and contacting you about it, Art. 6(1)(b) GDPR. Where the form asks for consent to marketing communication, we rely on that consent (Art. 6(1)(a) GDPR) for the channel you provided.

Retention: as described under "Contact requests".

When we communicate with you by email, phone or WhatsApp, we process your contact details and the content of the communication to handle your matter. Emails are processed by our email provider; WhatsApp messages are transmitted via Meta's WhatsApp Business platform. If you use WhatsApp, WhatsApp itself also processes your data as its own controller under its terms.

Our staff receive internal notifications about new requests (by email and, where configured, by WhatsApp) so that we can respond quickly. These notifications contain only the details needed to process the request.

Legal basis: Art. 6(1)(b) GDPR where the communication concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR.

If you apply for a position or send a general application through our careers page, we process the details you provide for the recruitment process:

• first and last name, email address, phone number and whether you can be reached on WhatsApp
• current location, professional experience and, if provided, your LinkedIn profile
• the position you are interested in, your motivation and your answers to further questions in the form
• your CV, if you upload one
• the time and language of your application, the wording of the notice you confirmed, and the browser and referring page of your submission

Purpose: reviewing your application, contacting you about it and carrying out the recruitment process, including interview invitations or a rejection by email.

Legal basis: Art. 6(1)(b) GDPR (steps at your request before entering into a contract). Your application is never used for marketing, and we do not add you to newsletters or sales contact lists.

Talent pool: if you tick the optional talent pool checkbox, we keep your application beyond the current process so that we can contact you about future opportunities. This is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without giving reasons.

Who has access: only the people responsible for recruitment. Your CV is stored in private, access-controlled storage and is only opened via short-lived download links. Our service providers for hosting, database, email delivery and spam protection process the data on our behalf.

Retention: while your application is in progress, we keep it for the duration of the process. It is deleted automatically 6 months after your last application has been concluded. With your talent pool consent we keep it for up to 24 months from your consent or from the conclusion of your last application, whichever is later. If you withdraw your talent pool consent, the 6-month period applies again. If we work together, the details needed for the collaboration are transferred to our team records.

If you buy a property through us, we can invite you to our client portal. There we process your account data (name, email address), the data of your purchase case (property, timeline, tasks, payment schedule), documents that you upload or that we share with you, comments and the activity history of your case. We send you login links by email and notifications about your case by email and, if you choose so, by WhatsApp.

Purpose: providing you with a secure overview of your purchase and exchanging documents.

Legal basis: Art. 6(1)(b) GDPR. Where documents are required by law (for example identification for anti-money-laundering checks), Art. 6(1)(c) GDPR.

Access: only you (and people you are invited with for the same case) and the team members responsible for your case. Documents are stored in private storage and are only opened via short-lived links.

Retention: for the duration of the purchase and the business relationship, and afterwards as long as statutory retention obligations require.

As a licensed real estate broker in the United Arab Emirates, we are legally obliged to identify our clients and to carry out due diligence before and during a property transaction, in particular under Federal Decree-Law No. 10 of 2025 on combating money laundering and its implementing regulations.

Data processed: identification documents (for example passport, Emirates ID, visa), date of birth, nationality, address, information on the source of funds and wealth, the transaction data, and the results of screening against sanctions and watch lists.

Recipients: where this is necessary for the transaction, we pass data to the developer or seller, the Dubai Land Department and its registration trustees, banks and payment service providers involved and, where legally required, to the competent authorities, in particular the UAE Financial Intelligence Unit.

Legal basis: Art. 6(1)(c) GDPR and the corresponding legal obligations under UAE law; for the preparation and performance of the purchase Art. 6(1)(b) GDPR.

Retention: at least five years after the end of the business relationship or the completion of the transaction, as required by anti-money-laundering law.

To be able to prove consents you have given or withdrawn, we record for consents given in forms the wording of the notice or checkbox you confirmed, the time and the language.

For your cookie choices we record the decision, the categories concerned, the time, the page and language, the browser used and a shortened IP address.

Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

Retention: as long as we need to be able to prove the consent, that is for as long as the consent is used plus the limitation period for possible claims.

We only pass on your data where this is necessary for the purposes described above. Service providers who process data on our behalf are bound by data processing agreements (Art. 28 GDPR). Advertising and social platforms that you use are their own controllers.

In addition, data may be passed to public authorities, courts or advisers bound to professional secrecy (for example lawyers, tax advisers, auditors) where we are legally obliged to do so or where it is necessary to establish, exercise or defend legal claims.

We use the following service providers:

Some of the service providers listed above are located outside the EU/EEA, in particular in the USA, or can access data from there. We only transfer data to such countries if the requirements of Art. 44 et seq. GDPR are met: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified US companies), EU Standard Contractual Clauses, or, for specific cases, your explicit consent (Art. 49(1)(a) GDPR). The table above names the safeguard for each provider. You can request a copy of the safeguards from us.

As we are established in the United Arab Emirates, the data you send us is processed by us in the UAE. The European Commission has not adopted an adequacy decision for the UAE. When you contact us from the EU, we process your data in the UAE because this is necessary to answer your request and to perform pre-contractual measures or a contract with you (Art. 49(1)(b) GDPR). Our database and file storage are located in the EU (Frankfurt, Germany). For transfers from the UAE to other countries we comply with Articles 22 and 23 of the PDPL.

Unless a more specific period is stated above, we delete or anonymise personal data as soon as it is no longer needed for the purpose for which it was collected, you have withdrawn your consent and there is no other legal basis, or you have successfully objected. Statutory retention obligations (for example commercial, tax or anti-money-laundering law) can require us to keep certain data longer; during this period it is restricted to that purpose.

Deleted data can remain in backups of our systems until these backups are deleted according to our backup schedule. It is not restored or used for any other purpose in the meantime.

You have the following rights regarding your personal data:

• Access to the data we hold about you and information about its processing (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data, unless we are legally obliged to keep it (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability: receiving the data you provided in a structured, commonly used, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing before the withdrawal remains unaffected

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons; we will then no longer use it for this purpose.

To exercise your rights, write to legal@inani-realestate.com. We may ask you to verify your identity. We respond without undue delay and at the latest within one month; the PDPL and GDPR allow this period to be extended in complex cases, in which case we inform you.

You can lodge a complaint with the UAE Data Office, the data protection authority established under Federal Decree-Law No. 44 of 2021.

If you are located in the EU, you also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

You are not obliged to provide personal data. Without the details marked as required in a form, however, we cannot handle the corresponding request (for example answer your inquiry or process your application). Technical data when visiting the website is required to deliver it.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

We protect your data with technical and organisational measures appropriate to the risk, including encrypted transmission (TLS), access controls based on roles and permissions, private file storage with short-lived access links, logging of access, regular backups and the careful selection and supervision of our service providers.

We update this privacy policy when our processing or the legal situation changes. The current version and its effective date are shown at the top of this page.

For all questions about data protection and to exercise your rights, contact us at legal@inani-realestate.com or by post at INANI REAL ESTATE LLC, Ahmad Building, Office G6, Hor Al Anz Area, Deira Dubai, United Arab Emirates.