Privacy Policy

This privacy policy is published by One Royal Orient LLC, a limited liability company registered in the Emirate of Dubai, United Arab Emirates, trading as One Royal Real Estate ("we", "us"). Registered office: Office 101, Dubai, UAE. Contact: hello@oneroyal.ae.

This policy explains what personal data we collect when you use this website, how we use it, who we share it with, how long we keep it, and your rights under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). It applies to every page under the oneroyal.ae domain.

(a) Information you give us through a form — your name, phone number, email address (where supplied), the property or service you are inquiring about, and any free-text message. (b) Information we collect automatically when you visit — your IP address, user-agent string, the page you arrived on, the page you left from, the country and city your IP resolves to, and basic device metadata. (c) Cookies — see our separate Cookie Policy for the cookies we set and why.

We process your data on the following legal bases under the PDPL: (i) Performance of a service you have asked for — replying to your inquiry, scheduling a viewing, sending you the documents you requested. (ii) Our legitimate interests — preventing fraud and abuse on our forms (Cloudflare Turnstile), measuring how visitors use the site (Google Analytics in privacy-preserving mode), and protecting the security of our infrastructure. (iii) Compliance with UAE law — keeping records of inquiries and contracts as required by Dubai real-estate regulation (RERA, Ejari) where they apply.

We do not sell or rent your personal data to anyone. We share data with the following sub-processors only to the extent necessary to deliver the service: Amazon Web Services, Inc. (hosting and email delivery via Amazon SES, eu-central-1 region in Frankfurt, Germany), Cloudflare, Inc. (Turnstile bot protection and DNS), Google LLC (Maps for property locations and Analytics in privacy mode). Each sub-processor has its own privacy notice, which applies in addition to ours. We do not transfer your data to advertising networks.

Our infrastructure runs in the European Union (AWS eu-central-1, Frankfurt). The PDPL permits transfers outside the UAE where the receiving jurisdiction provides an adequate level of protection or where appropriate safeguards are in place — the EU GDPR regime that applies to AWS Frankfurt is recognised as adequate for this purpose.

Inquiry records — 24 months from the date of submission, then deleted, unless we are required to keep them longer to perform an active contract or to comply with UAE law. Server logs and abuse-detection metadata — 90 days. Analytics data — 14 months, after which it is rolled into anonymous aggregates. Cookie identifiers — see our Cookie Policy.

Under PDPL Article 6 you have the right to: (i) be told whether we hold personal data about you and to receive a copy; (ii) ask us to correct inaccurate data or complete incomplete data; (iii) ask us to delete data we no longer need; (iv) ask us to restrict or stop processing in specific circumstances; (v) object to processing based on our legitimate interests; (vi) ask for a portable copy of the data you provided. To exercise any of these rights, write to hello@oneroyal.ae. We will reply within 30 calendar days. You also have the right to lodge a complaint with the UAE Data Office.

The site is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to us and we will delete it.

We protect personal data with industry-standard measures — TLS 1.2 or higher in transit, encryption at rest on managed databases and storage, role-based access controls, audit logging, and regular vulnerability scanning. No method of transmission or storage is 100 % secure; if a breach happens that is likely to result in a high risk to your rights, we will notify the UAE Data Office and the affected individuals as required by the PDPL.

We will post any material changes here with an updated "last updated" date. If a change materially affects how we use existing data we already hold about you, we will notify you by the email address you have given us (where applicable) before the change takes effect.

This page is a working draft pending review by UAE-licensed counsel. The clauses above describe our actual practices and apply unless and until counsel issues amended wording. Tracking entry: tech-debt P3-012.