Privacy Policy

The following Privacy Policy provides an overview of how ITHRA (which includes ITHRA DUBAI L.L.C and all of its subsidiaries, affiliates, companies under its management and other related companies (together “we”, “us” “our” or “ITHRA”) collect, use and process the Personal Data (as defined below) you or Data Subjects provide to us. This Privacy Policy applies to you because you are, will be or were a landlord or a tenant in a property owned and/or managed by ITHRA and you have provided us with your own Personal Data or the Personal Data of other individuals (e.g. employees, tenants, or otherwise) in relation to the tenancy arrangement we have with you (together “Data Subjects”). Data Subjects may also include individuals who have provided their Personal Data directly to us in relation to your arrangement with us.

This Privacy Policy sets out the rights of the Data Subjects whose Personal Data we have been provided with, in accordance with applicable data protection laws and regulations in the UAE, including the Federal Decree-Law No. 45/2021 On the Protection of Personal Data, as amended from time to time (“Data Protection Laws”).

1. DEFINITIONS

For the purposes of this Privacy Policy, the below terms are defined as follows:

• “Personal Data” means any data relating to an identified natural person, or one who can be identified directly or indirectly by way of linking data, using identifiers such as name, voice, picture, identification number, online identifier, geographic location, or one or more special features that express the physical, psychological, economic, cultural or social identity of such person. It also includes Sensitive Personal Data and Biometric Data.
• “Biometric Data” means Personal Data resulting from Processing, using a specific technique, relating to the physical, physiological or behavioral characteristics of a Data Subject, which allows or confirms the unique identification of the Data Subject, such as facial images or fingerprint data.
• “Sensitive Personal Data” means any data that directly or indirectly reveals a natural person’s family, racial origin, political or philosophical opinions, religious beliefs, criminal records, Biometric Data, or any data related to the health of such person, such as his/her physical, psychological, mental, genetic or sexual condition, including information related to health care services provided thereto that reveals his/her health status.

2. WHO IS THE CONTROLLER OF PERSONAL DATA AND HOW CAN YOU CONTACT THEM

For the purposes of applicable Data Protection Laws, the applicable ITHRA entity which contracts with you will be a data controller processing the Personal Data of Data Subjects. This means that we are responsible for determining the purposes and means of processing your Personal Data. Depending on the data processing taking place, there may be more than one ITHRA entity processing your Personal Data,

You may also be a data controller if you collect, use and process the Personal Data of Data Subjects.

ITHRA is a property developer as well as a commercial and residential asset manager operating in the UAE.

Any questions about this Privacy Policy, or for more information regarding our processing of Data Subjects’ Personal Data, please contact us at [email protected].

3. WHAT PERSONAL DATA AND SOURCES DO WE USE

We process Personal Data in a variety of ways when you interact with ITHRA, both physically and online. Some examples include:

Personal Data that we obtain directly from you or a Data Subject, either electronically or in hard copy:

• through use of our website(s) [and any mobile application(s)];
• enquiries about our products and/or services;
• contact by phone, by email or by any other forms of electronic communication;
• visits to our kiosks, events and/or offices;
• when a tenancy application is created or a lease or license entered into with us;
• through participation in surveys or promotions;
• when making payments to us; or
• otherwise, as a result of any other engagement with ITHRA.

Personal Data that we obtain from third parties we engage with, or are otherwise publicly available, such as:

• brokers and agents working on our behalf;
• security and facility management companies providing services for properties owned and/or managed by us;
• credit reference agencies;
• social media platforms where the Data Subjects have given permission to share your Personal Data;
• joint marketing partners; and
• fraud prevention and law enforcement authorities.

We process the following categories of Personal Data, which may include but are not limited to:

• personal contact details (e.g. name, phone number, email address, address and other contact details);
• date of birth, place of birth, gender and nationality;
• identification data (e.g. passport copies, Emirates ID / government ID copies, driver’s licenses and birth certificates);
• marital status (e.g. marriage certificate), family details and household composition;
• tenancy data (e.g. tenant details, key holder names, emergency details, defects you notify to us regarding your property, enquiries you make regarding your tenancy);
• employment data (e.g. proof of employment, work permit, residency visa, employer, employment status);
• KYC data (e.g. references, prior leasing history, prior residential addresses, sponsor details, trade licenses, VAT certificate (if applicable), powers of attorney, etc.);
• monitoring information (e.g. CCTV footage that capture and/or record your image when you visit us);
• financial data (e.g. salary/income details/certificates, outstanding rental fees – paid or in arrears, tenancy deposits, services charges, bank account numbers and statements); and
• additional data you may choose to provide us with, for example when accessing our website (e.g. username) or when we provide our products and services to you (e.g. conversations between us through emails, letters or other forms of electronic communication).

In certain limited circumstances, we may process Sensitive Personal Data. This could potentially include details about a Data Subject’s race or ethnicity, Biometric Data (e.g. fingerprints), health data and/or details about criminal convictions (e.g. police clearance certificate).

4. WHAT DO WE PROCESS YOUR PERSONAL DATA FOR (PURPOSE OF PROCESSING) AND ON WHAT LEGAL BASIS

ITHRA processes Personal Data on various legal grounds (depending on the applicable Data Protection Laws) including:

• if the processing is necessary to perform a contract to which the Data Subject is a party;
• if the processing is necessary to fulfil obligations imposed on us by other laws in the UAE;
• if the processing is necessary to protect the public interest;
• if the processing is necessary to protect the interests of the Data Subject; or
• as a result of Data Subject

Data subjects should be made aware that they can withdraw their consent at any time by contacting us using the contact details above.

ITHRA processes Personal Data for various purposes which may include but are not limited to:

• onboarding landlords and/or tenants;
• managing the building ;
• complying with applicable laws;
• marketing purposes; and/or
• for the performance of our tenancy agreement (or other contracts or policies).

5. WHO RECEIVES PERSONAL DATA AND WILL THE DATA BE TRANSFERRED TO A THIRD COUNTRY

For the purposes described in this Privacy Policy, and subject to applicable Data Protection Laws, Personal Data may be shared with recipients outside of ITHRA, such as third party property owners (of properties where ITHRA leases and manages properties) and ITHRA’s suppliers and service providers including:

• brokers and agents;
• facilities management;
• accounting;
• payroll providers;
• IT;
• security;
• marketing; and
• professional advisers that perform services on our behalf, as well as with other third parties such as banks, insurers, credit reference agencies, pension providers and government, public and judicial authorities, as the case may be.

ITHRA may transfer Personal Data to countries located outside of the UAE. This may happen when ITHRA’s suppliers and/or service providers are based outside of the UAE. ITHRA will transfer the Personal Data in accordance with applicable Data Protection Laws and use the applicable protection measures granted thereunder.

6. HOW DO WE PROTECT YOUR PERSONAL DATA

ITHRA has implemented reasonable and appropriate technical and organizational security measures to protect Data Subject Personal Data against unauthorized access, disclosure, misuse, loss or destruction. This includes encrypting Personal Data, implementing data back-up measures and regularly conducting security testing.

7. FOR HOW LONG WILL MY PERSONAL DATA BE STORED

ITHRA will process and store Personal Data only for as long as it is necessary in order to fulfil the purposes for which it was collected, including to meet its contractual and statutory obligations and/or to comply with legal, regulatory, accounting, reporting or internal policy requirements.

If the Personal Data is no longer required in accordance with the above, it is deleted.

8. DATA SUBJECT RIGHTS

Depending on the applicable Data Protection Laws, and subject to certain limitations under these laws, a Data Subject has certain rights in relation to their Personal Data. These include the right to:

• access Personal Data;
• obtain and request the transfer of Personal Data;
• correct and/or erase Personal Data;
• restrict, and stop, the Processing of Personal Data;
• object to, and stop, the Processing of Personal Data; and
• object to decisions made by automated processing, that have legal consequences or seriously affect the Data Subjects.

If any Data Subject has any questions about the type of Personal Data we hold about them or if they wish to exercise any Data Subject right, they can contact us at [email protected].

A Data Subject can withdraw any consent for the processing of Personal Data at any time. The withdrawal will not affect the lawfulness of any processing based thereon before the withdrawal.

Whilst we will make reasonable efforts to accommodate any Data Subject rights request to the extent, and as soon as reasonably, practicable, we reserve the right to reject such requests or to impose restrictions or requirements upon such requests if required or permitted by applicable laws.

9. USE OF PERSONAL DATA FOR DIRECT MARKETING

If a Data Subject has provided their consent for the purposes of marketing our products and services to them, we may process their Personal Data for such purposes. Any marketing by us, or any third parties on our behalf, will be conducted in accordance with applicable laws. Marketing includes, but is not limited to, contact by email, text message, social media and/or phone.

A Data Subject has the right to object to the Processing of their Personal Data for marketing purposes at any time and can exercise this right by sending an “opt-out” email to [email protected]. 

10. ARE YOU OBLIGED TO PROVIDE THE PERSONAL DATA

We may require certain Personal Data to comply with our legal or contractual obligations and/or to provide our products and services to you. If a Data Subject fails to provide their Personal Data or withdraws their consent to our Processing their Personal Data, we may not be able to provide you with such products and services or, if applicable, continue our business relationship with you. We will notify you if this is the case.