GDPR Compliance
Last Updated: July 18, 2026 | Effective Immediately
At Aqaro Realty, we are fully committed to protecting the personal data and privacy of individuals within the European Economic Area (EEA) and beyond. This GDPR Compliance page details our adherence to the General Data Protection Regulation (EU) 2016/679, as well as our ongoing efforts to maintain transparency, security, and control over your personal information.
What is the GDPR?
The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union. It governs how organizations collect, process, store, and transfer personal data of individuals in the EU. The GDPR grants individuals greater control over their personal data and imposes strict obligations on businesses that handle such data, regardless of where the business is located.
Even though Aqaro Realty primarily operates in the United Arab Emirates, we recognize that our digital marketing campaigns and property services may attract interest from EU residents. Therefore, we voluntarily align our data practices with GDPR standards to ensure the highest level of protection for all our users.
Our Role as a Data Controller
Aqaro Realty acts as a Data Controller for the personal information you provide through our website, lead generation forms, and Meta Ads. This means we determine the purposes and means of processing your personal data. We are responsible for ensuring that your data is processed lawfully, fairly, and transparently.
Lawful Basis for Processing
Under the GDPR, we rely on one or more of the following lawful bases to process your personal data:
Consent: When you actively submit a form on our website or through a Meta Lead Ad, you provide explicit consent for us to use your data for the stated purposes (e.g., property inquiries, appointment scheduling).
Legitimate Interests: We may process data to improve our services, secure our website, and analyze campaign performance, provided these interests are not overridden by your rights and freedoms.
Legal Obligation: When necessary to comply with applicable laws, regulatory requests, or court orders.
You have the right to withdraw consent at any time, and we will cease processing your data for the relevant purposes promptly.
Your Rights Under the GDPR
The GDPR provides you with the following rights concerning your personal data. To exercise any of these rights, please contact us using the details at the bottom of this page. We will respond to all legitimate requests within 30 calendar days.
Right to Access (Art. 15): Obtain confirmation of whether we process your personal data, and if so, access to that data along with relevant details.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data without undue delay.
Right to Erasure (Art. 17): Also known as the "Right to be Forgotten", you can request deletion of your data when there is no compelling reason for its continued processing.
Right to Restrict Processing (Art. 18): Ask us to temporarily suspend processing of your data under certain circumstances.
Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine‑readable format and have the right to transmit it to another controller.
Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling for direct marketing purposes.
Rights Related to Automated Decision-Making (Art. 22): We do not use automated decision-making or profiling that produces legal effects. If that changes, you will be informed and have the right to obtain human intervention.
Data Minimization & Retention
We adhere to the principle of data minimization – collecting only the personal data that is directly relevant and necessary for the specified purposes (e.g., name, email, phone, property preferences). We do not collect sensitive categories of data (such as health information, political opinions, or biometric data) through our marketing channels.
Personal data is retained only for as long as required to fulfill the purpose for which it was collected, typically up to 24 months after the last interaction. In some cases, we may retain anonymized data indefinitely for analytical purposes. After the retention period, all personally identifiable information is securely deleted or irreversibly anonymized.
Data Security & Breach Notification
We implement robust technical and organizational measures to protect your personal data, including:
Full HTTPS/SSL encryption for all data transmission.
Strict access controls: only authorized personnel can view your data.
Regular security assessments and monitoring.
In the unlikely event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by the GDPR. If the breach poses a high risk to your rights and freedoms, we will also inform you without undue delay.
International Data Transfers
Your personal data may be processed and stored in the United Arab Emirates, or in other countries where our trusted service providers (e.g., cloud storage, scheduling tools) are located. When transferring data outside the EEA, we ensure that adequate safeguards are in place, such as standard contractual clauses approved by the European Commission, to protect your privacy rights.
Children's Data
Our services are not directed at individuals under the age of 18. We do not knowingly collect or process personal data from children. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete it.
Contact & Data Protection Representative
For all inquiries related to GDPR compliance, data subject rights, or any privacy concern, you may contact our representative directly:
Taufique Hussain
We are committed to upholding the highest standards of data protection. If you believe that your data protection rights have been infringed, you also have the right to lodge a complaint with a supervisory authority in your EU member state of residence.