Privacy Policy

This Privacy Policy explains how VIP Dubai Off Plan ("we," "us," or "our"), operating at vipdubaioffplan.com, collects, uses, stores, discloses, and protects personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), which came into force on 2 January 2022. By using our website or submitting an inquiry, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller Information

VIP Dubai Off Plan is the data controller responsible for personal data collected through this website and its associated communication channels.

• Business Name: VIP Dubai Off Plan
• Website: vipdubaioffplan.com
• Office Address: Marina Plaza, Dubai Marina, Dubai, UAE
• Phone / WhatsApp: +971 50 438 0503
• Data Inquiries: vipdubaioffplan.com/contact/

For all data protection enquiries, requests to exercise your rights, or concerns about how your data is handled, please contact us via the channels above.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected through:

• Our website at vipdubaioffplan.com and any subdomains or associated pages.
• Contact forms, inquiry submissions, and callback requests made through the website.
• WhatsApp communications initiated via links on this website.
• Cookies, tracking technologies, and analytics tools deployed on our website.

This Policy does not apply to the privacy practices of third-party developers, brokers, or websites that we may link to. We encourage you to review the privacy policies of any third-party services you engage with as a result of visiting our website.

3. Personal Data We Collect

3.1 Information You Provide Directly

When you submit a contact form or inquiry, we collect the following information:

• Full name — required to address you appropriately.
• Email address — required to respond to your inquiry.
• Phone number — optional, provided if you wish to be contacted by phone or WhatsApp.
• Message content — your inquiry, property preferences, budget range, or other details you choose to include.
• Preferred property type or area — where selected from form options.

We collect only the information you voluntarily choose to submit. You are not required to provide personal data to browse our website.

3.2 Information Collected Automatically

When you visit our website, certain technical data is collected automatically through analytics services and server logs:

• IP address — collected and anonymised or aggregated by our analytics providers.
• Browser type and version — for compatibility and performance analysis.
• Operating system and device type — to understand how our website is accessed.
• Pages visited and navigation paths — to understand user behaviour and improve content.
• Referring URLs — the source that directed you to our website.
• Session duration and engagement metrics — aggregated data on how users interact with our content.
• General geographic location — derived from IP address at a country or city level only; we do not collect precise GPS location data.

4. Legal Basis for Processing Your Data

Under Article 5 of UAE Federal Decree-Law No. 45 of 2021 (PDPL), we process personal data only where a lawful basis exists. The legal bases on which we rely are:

• Consent — By submitting a contact form or inquiry, you provide explicit consent for us to process your personal data for the purpose of responding to your request. You may withdraw consent at any time by contacting us.
• Legitimate Interests — We process automatically collected analytics data on the basis of our legitimate interest in understanding how our website performs and improving user experience, provided this does not override your fundamental privacy rights.
• Legal Obligation — We may process data to comply with applicable UAE laws, regulatory requirements, or lawful requests from competent authorities.
• Protection of Vital Interests — In exceptional circumstances, where processing is necessary to protect the vital interests of an individual.

5. How We Use Your Personal Data

We use personal data collected through this website for the following specific purposes:

• Responding to inquiries: To contact you with relevant property information, advisory guidance, and answers to your questions about the Dubai off-plan market.
• Making introductions: Where appropriate and with your knowledge, to connect you with RERA-registered brokers or DLD-licensed developers who can assist with property transactions.
• Website improvement: To analyse aggregated usage data, identify popular content, and improve the layout, performance, and relevance of our website.
• Security: To detect, prevent, and respond to fraud, bot attacks, spam submissions, and other malicious activity.
• Legal compliance: To comply with applicable laws, respond to lawful regulatory enquiries, and enforce our Terms of Service.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

6. Analytics and Tracking Technologies

6.1 Google Analytics 4 (GA4)

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, to collect anonymised data about how visitors use our website. GA4 uses first-party cookies to track sessions, page views, traffic sources, and engagement metrics.

GA4 data is processed in accordance with Google's Privacy Policy and data processing terms. IP anonymisation is enabled where available, meaning full IP addresses are not stored by Google. Data collected by GA4 is retained by Google for 14 months by default.

You can opt out of Google Analytics tracking at any time by installing the Google Analytics Opt-Out Browser Add-on, or by adjusting your browser's cookie settings.

6.2 Cloudflare Web Analytics

We also use Cloudflare Web Analytics, a privacy-first analytics service that does not use cookies, fingerprint individual users, or track users across websites. Cloudflare Web Analytics collects only aggregate, anonymised data about page views and general traffic patterns. No personal data is stored or processed by this tool.

7. Cookies and Local Storage

Cookies are small text files placed on your device by websites you visit. We use a minimal number of cookies in accordance with UAE and international best practices.

7.1 Cookies We Use

• Google Analytics cookies (_ga, _ga_*) — First-party analytics cookies set by Google Analytics 4. These expire after 2 years and collect anonymised usage data. These are functional-analytics cookies.

7.2 Local Storage

Our Accessibility Toolbar stores your accessibility preferences (such as font size, contrast mode, and motion settings) in your browser's localStorage — not as a cookie. This data is stored only on your device, is not transmitted to our servers, and persists until you clear your browser data or reset your accessibility preferences.

7.3 Cookies We Do Not Use

We do not use third-party advertising cookies, social media tracking pixels, cross-site behavioural tracking, or any cookies designed to build individual user profiles for advertising purposes. The Meta Pixel is present in our code but is currently inactive and does not collect data.

You can manage or delete cookies through your browser settings at any time. Disabling analytics cookies will not affect your ability to browse or use any features of our website.

8. Cloudflare Services and Data Security

Our website is delivered through the Cloudflare global network (Cloudflare, Inc., San Jose, California, USA). Cloudflare provides the following services that may involve the processing of data:

• Content Delivery Network (CDN): Routes traffic through Cloudflare's servers, which may log request metadata such as IP addresses for security and performance purposes. Cloudflare's data retention practices are governed by its own privacy policy.
• DDoS Protection and Web Application Firewall: Analyses incoming traffic patterns to identify and block malicious requests. This may involve temporary processing of IP address and request metadata.
• SSL/TLS Encryption: All data transmitted between your device and our website is encrypted in transit using industry-standard TLS protocols. Cloudflare terminates the SSL connection and re-encrypts traffic to our origin server.
• Cloudflare Turnstile: Our contact forms are protected by Cloudflare Turnstile, a privacy-preserving CAPTCHA alternative. Unlike traditional CAPTCHAs, Turnstile does not use tracking cookies or fingerprinting to identify users and does not build user profiles. It analyses interaction signals to distinguish human users from automated bots, in accordance with Cloudflare's privacy-first design principles.

9. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. We may share personal data only in the following limited circumstances:

• Service Providers: We engage trusted third-party service providers who process data on our behalf under strict data processing agreements. These include our email delivery service (Resend), website hosting (Cloudflare Pages), and analytics providers (Google). These processors are contractually bound to process data only as instructed and in compliance with applicable data protection law.
• RERA-Registered Brokers and Developers: Where you have submitted an inquiry and expressed interest in a specific property or development, and where doing so is consistent with the purpose of your inquiry, we may share your contact details with a relevant RERA-registered brokerage or DLD-licensed developer to facilitate follow-up. We will not do so without a reasonable expectation that this aligns with your inquiry.
• Legal Requirements: We may disclose personal data where required to do so by UAE law, court order, regulatory authority (including the UAE Data Office), or where necessary to protect our legal rights or the safety of any individual.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our business, personal data held may be transferred to the successor entity, subject to equivalent privacy protections.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable UAE law:

• Contact form submissions: Personal data submitted via our contact forms is transmitted by email through our delivery provider and is not stored on our own servers beyond the period necessary to respond to your inquiry. Email records may be retained for up to 12 months for administrative and follow-up purposes, after which they are deleted.
• Analytics data: GA4 session and usage data is retained by Google for a maximum of 14 months as configured in our GA4 account, after which it is automatically deleted. Cloudflare Web Analytics data is aggregated and anonymised; no individual-level data is retained.
• Legal obligation records: Where we are required by UAE law to retain records (for example, to comply with anti-money laundering record-keeping requirements), we will retain data for the periods mandated by law, typically five years.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an individual.

11. International Data Transfers

Our website is a globally accessible platform and some of our service providers are based outside the United Arab Emirates. In particular:

• Google (GA4): Data may be processed by Google LLC in the United States and other jurisdictions where Google operates data centres.
• Cloudflare: As a global network provider, Cloudflare may process request metadata across its worldwide points of presence, including in the USA, Europe, and Asia.
• Resend (email delivery): Our email delivery provider may process data in the United States.

Where personal data is transferred outside the UAE, we take steps to ensure that appropriate safeguards are in place as required by Article 26 of UAE Federal Decree-Law No. 45 of 2021. These safeguards may include standard contractual clauses, adequacy decisions, or processor agreements that provide equivalent levels of data protection. You may request information about the specific safeguards applicable to any international transfer by contacting us.

12. Your Rights Under UAE PDPL

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you have the following rights with respect to your personal data:

• Right of Access: You have the right to request confirmation of whether we process your personal data, and to obtain a copy of that data in a structured, machine-readable format.
• Right to Rectification: You have the right to request that inaccurate, incomplete, or outdated personal data we hold about you is corrected or updated.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful — subject to our legal retention obligations.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data based on our legitimate interests, where our interests are overridden by your fundamental rights and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Restrict Processing: In certain circumstances, you may request that we restrict the processing of your personal data while a dispute about its accuracy or lawfulness is resolved.

To exercise any of these rights, please contact us using the details in Section 16. We will respond to all verified requests within 30 calendar days of receipt. In complex cases, we may extend this period by an additional 30 days, in which case we will notify you of the extension and reason for delay.

You also have the right to lodge a complaint with the UAE Data Office, the competent supervisory authority responsible for enforcing the PDPL, if you believe that our processing of your personal data violates applicable data protection law.

13. Data Security Measures

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• HTTPS encryption: All data in transit between your browser and our website is encrypted using TLS (Transport Layer Security).
• Cloudflare DDoS and WAF protection: Our website is shielded against network-level attacks and malicious web requests.
• Cloudflare Turnstile: Contact forms are protected against automated spam and bot submissions without compromising user privacy.
• Minimal data collection: We follow a data minimisation principle — we collect only the personal data we genuinely need for the stated purpose.
• Access controls: Access to personal data received via contact form submissions is restricted to authorised personnel only.
• Static website architecture: Our website is a statically generated site hosted on Cloudflare Pages, which eliminates many common server-side vulnerabilities associated with dynamic web applications and database-driven platforms.

No system is entirely immune from security risk. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the UAE Data Office and affected individuals in accordance with our obligations under UAE PDPL.

14. Children's Privacy

This website is directed exclusively at adults. Under UAE law, the minimum age of contractual capacity is 21 years (UAE Federal Law No. 5 of 1985, Civil Transactions Law), and property investment is strictly an adult activity. We do not knowingly collect, process, or store personal data from individuals under the age of 18.

If you believe that a person under 18 has submitted personal data to us, please contact us immediately using the details in Section 16 and we will take prompt steps to delete such data from our records.

15. Links to External Websites

Our website contains links to third-party websites including developer portals, government platforms (DLD, RERA), financial service providers, and media publications. This Privacy Policy applies solely to data collected by vipdubaioffplan.com. We are not responsible for the privacy practices of linked third-party websites, and we encourage you to review their privacy policies before submitting any personal data.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our data practices, applicable law, or the services we provide. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this Policy regularly to stay informed about how we protect your personal data.

Your continued use of our website following any update to this Privacy Policy constitutes your acceptance of the revised version. If you do not agree with changes to this Policy, you should cease using our website.

17. Contact and Data Inquiries

For all privacy-related enquiries, requests to exercise your data subject rights, concerns about how your personal data is handled, or to request a copy of the data we hold about you, please contact us through the following channels:

• Contact Form: vipdubaioffplan.com/contact/
• Phone / WhatsApp: +971 50 438 0503
• Office: Marina Plaza, Dubai Marina, Dubai, UAE

We are committed to handling all data enquiries with care, transparency, and in full compliance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.