Privacy Policy

1. Introduction

Dubai Tax & Property (“we,” “us,” or “our”) is committed to protecting the privacy and security of your personal data. We operate the website https://dubaitaxandproperty.com (the “Site”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, in strict compliance with the UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL), the UAE Consumer Protection Law No. 15 of 2020, and applicable international standards such as the General Data Protection Regulation (GDPR).

We respect your right to privacy. We do not rely on implied consent; we ensure that you have full control over your data through clear options and transparent practices.

2. Information We Collect

We adhere to the principle of Data Minimization, collecting only the information necessary for legitimate business purposes.

2.1 Personal Data You Voluntarily Provide

We may collect “Personal Data”—information that identifies you as a specific individual—only when you voluntarily provide it to us through our contact forms or email correspondence. This includes:

• Identity Data: First name and last name.
• Contact Data: Email address and telephone number.
• Inquiry Data: Details regarding your property interests, tax queries, or other information contained in your messages.

Legal Basis for Processing: We process this data based on your Consent (Article 6 of PDPL) given at the time of submission, and our Legitimate Interest to respond to your specific inquiries.

2.2 Technical and Usage Data (Automated Collection)

When you access our Site, we may automatically collect certain data from your device. While this information does not directly reveal your identity (like your name), it may be linked to you and is treated with the same level of security.

• Device Identifiers: IP address, browser type and version, time zone setting, operating system, and platform.
• Usage Data: Pages you viewed, how long you stayed on a page, clickstream data, and navigation paths.

Legal Basis for Processing: We process this data to ensure network security (Legitimate Interest) and to analyze website performance (Consent via Cookie Banner).

3. How We Use Your Information

We use the information we collect for specific, defined purposes:

Purpose	Description	Legal Basis
Communication	To respond to your inquiries, questions, and comments submitted via our contact forms.	Consent / Contractual Necessity
Operational Analysis	To analyze usage trends and traffic patterns to improve the Site’s functionality and content.	Consent (for Analytics)
Security	To detect, prevent, and address technical issues, fraud, or abuse of our services.	Legitimate Interest
Marketing	To send you updates, newsletters, or property alerts only if you have explicitly opted in.	Explicit Consent

Strict Limitation on Marketing: In compliance with UAE Consumer Protection Law, we will never use the phone number or email provided in a general inquiry for direct marketing campaigns without your separate, explicit written consent.

4. Cookies and Tracking Technologies

Our Site uses cookies to enhance your experience. A “cookie” is a small text file placed on your device.

4.1 Cookie Categories

• Strictly Necessary Cookies: Essential for the website to function (e.g., security tokens). These cannot be switched off.
• Analytical/Performance Cookies: Allow us to count visits and traffic sources (using Google Analytics) so we can measure and improve the performance of our site. These cookies collect information in a way that does not directly identify anyone.

4.2 Your Control (The “Opt-In” Standard)

Unlike older policies that required you to “disable” cookies, we operate on a “Prior Consent” basis.

• Default Block: Non-essential cookies (such as Google Analytics) are blocked by default.
• Consent Banner: These cookies will only be activated if you click “Accept” on our cookie banner.
• Withdrawal: You can withdraw your consent at any time via the “Cookie Settings” link in the footer of our website.

5. Third-Party Services and International Data Transfers

To provide our services, we may share data with trusted third-party service providers (“Data Processors”).

5.1 Key Service Providers

• Google Analytics (USA): Used for website traffic analysis. We have enabled IP Anonymization to protect your privacy.
• Hosting Providers: Our website is hosted on secure servers which may be located outside the UAE.

5.2 Cross-Border Data Transfer

Your information, including Personal Data, may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

• Consent to Transfer: By using our Site and providing us with your information, you explicitly consent to this transfer in accordance with Article 17 of the UAE PDPL. We take all reasonably necessary steps to ensure that your data is treated securely, including the use of encryption and contractual confidentiality obligations.

6. Data Security

We employ robust technical and organizational measures to protect your Personal Data from unauthorized access, alteration, disclosure, or destruction.

• Encryption: We use Secure Socket Layer (SSL) technology to encrypt data during transmission.
• Access Control: Access to your data is restricted to authorized personnel who have a legitimate business need to access it.
• Disclaimer: Please be aware that no method of transmission over the Internet is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

7. Your Rights (Data Subject Rights)

Under the UAE PDPL, you have specific rights regarding your personal data. We are committed to facilitating these rights:

1. Right to Access: You have the right to request a copy of the personal data we hold about you.
2. Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
3. Right to Erasure: You have the right to request that we delete your personal data (“Right to be Forgotten”), subject to certain legal exceptions (e.g., tax record retention).
4. Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data.
5. Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, in a structured, machine-readable format.
6. Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us at: [dubaitaxandproperty@gmail.com / privacy@dubaitaxandproperty.com]

We will respond to your request within 30 days.

8. Telemarketing and Communication Standards

We strictly adhere to the Cabinet Resolution No. 56 of 2024 regarding telemarketing.

• No Cold Calling: We do not engage in unsolicited telemarketing. We will only contact you via telephone if you have specifically requested a call-back regarding a property or inquiry.
• Do Not Call Registry (DNCR): We respect the National Do Not Call Registry.
• Anti-Spam: We do not send unsolicited commercial emails (UCE). All our marketing emails include a clear, one-click “Unsubscribe” link.

9. Data Retention

We retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.

• Correspondence: Retained for 2 years after the closure of the inquiry to ensure customer service continuity.
• Analytics Data: Retained for 14 months (Google Analytics standard retention).
• Legal Records: If a transaction occurs, financial records are retained for a minimum of 5 years in compliance with UAE Tax Procedures Law.

10. Children’s Privacy

Our Site is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to remove that information from our servers.

11. External Links and Third Parties

Our Site may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in legal or regulatory requirements. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date. You are advised to review this Privacy Policy periodically for any changes.

13. Legal Disclaimer

Educational Purpose: All content provided on Dubai Tax & Property is for educational and informational purposes only. It does not constitute professional legal, tax, or financial advice. No Fiduciary Relationship: Using this website or contacting us does not create a client-professional relationship. Professional Advice: Laws and regulations in the UAE change frequently. You should always consult with a qualified professional (lawyer, tax consultant, or financial advisor) before making decisions based on information found on this website.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: dubaitaxandproperty@gmail.com
• Website: https://dubaitaxandproperty.com

---

6. Implementation Guide: Moving from Policy to Practice

A privacy policy is a living document that must be reflected in the technological and operational reality of the business. The following implementation steps are required to validate the policy drafted above.

6.1 Technological Implementation

6.1.1 Email Migration

Risk: The use of dubaitaxandproperty@gmail.com presents a professionalism risk and a data control risk. In a Gmail environment, Google acts as a controller for its own purposes. Recommendation: Migrate to a domain-based email (e.g., info@dubaitaxandproperty.com) using a business provider (Google Workspace or Microsoft 365). This allows for a Data Processing Agreement (DPA) to be signed with the provider, ensuring they process data only on your instructions, satisfying Article 8 of PDPL (Obligations of the Controller).

6.1.2 Consent Management Platform (CMP) Setup

To satisfy the “Hard Opt-In” requirement for cookies:

1. Select a CMP: Tools like CookieYes, OneTrust, or Cookiebot are standard.
2. Categorization: Run a scan of the website. Identify Google Analytics cookies (_ga, _gid). Classify them as “Analytics.”
3. Script Blocking: Configure the CMP to block the Google Analytics script tag from loading until the consent signal is received.
4. Log Consent: Ensure the CMP records the Timestamp, IP (anonymized), and Consent Status of users to provide “proof of consent” if audited.

6.1.3 Google Analytics Configuration

1. IP Anonymization: Ensure the anonymize_ip parameter is set to true in your Google Analytics tracking code. This truncates the IP address before it is stored, significantly reducing privacy risk.
2. Data Retention: In the Google Analytics Admin panel, set “Data Retention” to 14 months (the lowest setting) rather than “Do not automatically expire.” This aligns with the Data Minimization principle.

6.2 Operational SOPs (Standard Operating Procedures)

6.2.1 Handling a Subject Access Request (SAR)

When a user emails asking to “see what data you have on me”:

1. Verify: Ask for a confirmation from the email address on file.
2. Collate: Search your email “Sent/Received” folders and any spreadsheet/CRM you use for their name.
3. Report: Create a simple PDF listing the data points held (e.g., “We hold your name, email, and the inquiry sent on”).
4. Send: Email this PDF to the user via a secure link or encrypted attachment if possible.

6.2.2 Marketing Discipline

To avoid fines under the 2024 Telemarketing Regulations:

• Golden Rule: Never add a contact form email address to a Mailchimp/newsletter list unless the user ticked the specific “Newsletter” box.
• Cold Calling: Never take a phone number from an email inquiry and use it for a cold sales call regarding a different property. You may only call back regarding the specific inquiry made.

6.2.3 Data Breach Response

If the Gmail account or website database is hacked:

1. Contain: Change passwords immediately.
2. Assess: Did the hacker access Personal Data (names, emails)?
3. Notify: If the breach creates a risk to user privacy (e.g., identity theft risk), you must notify the UAE Data Office and the affected users “immediately” as per Article 9 of PDPL.

6.3 Risk Assessment Summary

Risk Vector	Likelihood	Impact	Mitigation Strategy
Inadvertent Marketing (Spam)	Medium	High (Fines)	Strict separation of “Inquiry” lists and “Marketing” lists.
Cookie Non-Compliance	High	Medium (Regulatory)	Implementation of CMP with blocking script.
Data Breach	Medium	High (Reputational)	Strong passwords, SSL encryption, 2FA on email accounts.
Cross-Border Transfer Challenge	Low	Medium	Explicit consent clause in Privacy Policy (Section 5.2).

---

7. Conclusion

The transition from the initial privacy policy draft to this comprehensive framework represents a maturation of Dubai Tax & Property‘s digital governance. By adopting this text and the associated operational protocols, the organization insulates itself against the increasingly stringent regulatory environment of the UAE.

The new policy serves a dual function: it is a legal shield, protecting the entity from fines associated with PDPL and Telemarketing violations, and it is a trust signal, demonstrating to high-net-worth investors and casual browsers alike that their privacy is treated with the highest standard of professional care. The operational steps outlined—specifically the implementation of the Consent Management Platform and the migration to business-grade email—are immediate priorities to ensure that the policy is not just a document on a page, but a reflection of actual business practice.

Effective Date: January 30, 2026