Your privacy is important to us. This Privacy Policy explains how HopInHome LLC digital real estate marketplace platform ("HopInHome", "we", "us", "our") collects, uses, stores, shares, and protects your personal data when you use our Platform. It has been prepared in accordance with the UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data ("PDPL").

By using the Platform, you confirm that you have read and understood this Privacy Policy and consent to the collection, use, and transfer of your personal data as described herein. If you do not agree, you must cease using the Platform.

1. WHO WE ARE AND HOW TO CONTACT US

HopInHome LLC is the data controller of your personal data. The Platform is technically supported by HopInHome L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE (Meydan Free Zone license number 2538944.01).

Privacy enquiries: support@hopinhome.com

2. PERSONAL DATA WE COLLECT FROM YOU

"Personal Data" means any information from which a living individual is or can be identified, directly or indirectly (PDPL Art. 1). HopInHome applies the principle of data minimisation — we collect only what is necessary for the specified purpose. We do NOT collect or store scans or images of identity documents, trade licences, or title deeds. We collect reference numbers and expiry dates only.

Category: Identity Data

What We Collect: Full legal name, username, date of birth, account type.

PDPL Basis: Art. 4–5: Contractual necessity.

Category: Contact Data

What We Collect: Email address, mobile phone number (OTP verified), registered address.

PDPL Basis: Art. 4–5: Contractual necessity.

Category: Verification Data

What We Collect: Emirates ID number (reference only), passport number (reference only), trade licence number + expiry, BRN + expiry, permit numbers + expiry dates, name of authorised signatory. UAE Pass attributes (where integrated).

PDPL Basis: Art. 4–5: Contractual necessity; Art. 4: Data minimisation.

Category: Listing Data

What We Collect: Property details, photographs, videos, Title Deed reference number (DLD number only), permit numbers, pricing, availability.

PDPL Basis: Art. 4–5: Contractual necessity.

Category: Payment Data

What We Collect: PSP token only (NOT raw card number, CVV, or full card data). Billing address. VAT number (corporate). Card and banking details are handled entirely by our licensed PSP and are not stored by HopInHome.

PDPL Basis: Art. 4–5: Contractual necessity. CBUAE Retail Payment Services Regulation (2021).

Category: Technical Data

What We Collect: IP address, browser type, device identifiers, operating system, access timestamps, login data.

PDPL Basis: Art. 4: Legitimate interest (security).

Category: Behavioural Data

What We Collect: Pages viewed, search queries, listings contacted, features used. Typically aggregated into segments.

PDPL Basis: Art. 4: Legitimate interest (analytics).

Category: Communications Data

What We Collect: Support messages, compliance correspondence, messages via Platform or WhatsApp.

PDPL Basis: Art. 4–5: Contractual necessity.

Category: Call Data

What We Collect: Recordings of calls through the call-tracking feature (where activated). Users are notified before each recorded call.

PDPL Basis: Art. 4–6: Consent; Legitimate interest.

Category: Marketing Data

What We Collect: Preferences regarding marketing and promotional communications.

PDPL Basis: Art. 4–6: Consent.

Category: Device & App Data

What We Collect: Mobile device model, operating system version, app version, push notification token, crash logs. Collected automatically when you use our mobile application.

PDPL Basis: Art. 4: Legitimate interest (app performance, security).

We do NOT collect or store: identity document images (passport, Emirates ID, trade licence scans), title deed documents, or raw payment card numbers. Data minimisation is applied throughout in accordance with PDPL Art. 4.

3. PERSONAL DATA COLLECTED FROM OTHER SOURCES

Source — Categories of Data

Analytics providers — Behavioural Data, Technical Data

Advertising and marketing partners — Behavioural Data, Technical Data

Licensed PSP (payment processor) — Partial Payment Data, Identity Data (transaction confirmation)

UAE Pass (where integrated) — Verified identity attributes (name, Emirates ID reference, nationality) — platform receives attributes without storing ID documents. TDRA Relying Party framework.

Government / regulatory databases — Identity Data, Verification Data (for permit/licence compliance checks where API integration is enabled)

App stores (Apple App Store / Google Play) — Download and installation data (as provided by the respective store to app developers in accordance with store policies).

4. HOW WE USE YOUR PERSONAL DATA AND WHY

Purpose: Account registration and role verification

Data Categories: Identity, Contact, Verification

Legal Basis (PDPL): Art. 4–5: Contractual necessity

Purpose: Manual account review and approval

Data Categories: Identity, Verification

Legal Basis (PDPL): Art. 4–5: Contractual necessity; Legal obligation

Purpose: Platform operation and feature access

Data Categories: Identity, Contact, Listing, Behavioural

Legal Basis (PDPL): Art. 4–5: Contractual necessity

Purpose: Listing creation, publication, and compliance enforcement (permit validation, expiry suspension)

Data Categories: Listing, Verification, Permit fields

Legal Basis (PDPL): Art. 4–5: Contractual necessity; Legal obligation (RERA)

Purpose: Connecting Listing Users with Property Seekers (forwarding enquiry contact details)

Data Categories: Identity, Contact, Listing

Legal Basis (PDPL): Art. 4–5: Contractual necessity

Purpose: Processing subscription and booster fee payments via PSP

Data Categories: Identity, Contact, PSP token

Legal Basis (PDPL): Art. 4–5: Contractual necessity; CBUAE regulations

Purpose: Compliance monitoring, permit expiry enforcement, and regulatory record-keeping

Data Categories: Verification, Technical, Communications

Legal Basis (PDPL): Art. 4: Legal obligation (RERA, DLD, PDPL)

Purpose: Call tracking and recording (where activated)

Data Categories: Call Data, Identity

Legal Basis (PDPL): Art. 4–6: Consent; Legitimate interest

Purpose: Platform security, fraud prevention, and AML/DNFBP compliance

Data Categories: Technical, Identity, Communications

Legal Basis (PDPL): Art. 4: Legal obligation; Legitimate interest

Purpose: Analytics and Platform improvement

Data Categories: Behavioural, Technical (aggregated)

Legal Basis (PDPL): Art. 4: Legitimate interest

Purpose: Marketing communications (opt-in only)

Data Categories: Contact, Marketing

Legal Basis (PDPL): Art. 4–6: Consent

Purpose: Enforcing Terms of Use and resolving disputes

Data Categories: All relevant categories

Legal Basis (PDPL): Art. 4: Legitimate interest; Legal obligation

Purpose: Mobile push notifications (where consent given)

Data Categories: Device & App Data, Contact, Marketing

Legal Basis (PDPL): Art. 4–6: Consent

5. AUTOMATED DECISION-MAKING AND PROFILING

Certain features of the Platform operate through automated processing of your Personal Data without human review. Where those automated processes produce outcomes that materially affect your rights or access to Platform services, we are required by the PDPL to inform you of their existence and logic.

Automated processes currently in use

Automated Process: Listing suspension — permit expiry

Trigger / Logic: Platform checks permit expiry date fields on a scheduled basis. A Listing is suspended when its associated Trakheesi, DTCM, Madhmoun, or DCT permit reaches its expiry date (with advance alerts at 30 days).

Effect on You: Your Listing is hidden from search results and marked inactive. You are notified by email and in-app alert.

Automated Process: Listing suspension — BRN expiry

Trigger / Logic: Individual agent BRN expiry date is monitored. On expiry, all Listings associated with that agent are suspended.

Effect on You: Your Listings are hidden. Your brokerage admin is also notified.

Automated Process: Account restriction — non-payment

Trigger / Logic: Payment records are checked automatically after the subscription due date. Restrictions are applied at 3, 7, and 60-day thresholds in accordance with Section 15 of the Terms of Use.

Effect on You: Access to listing features is progressively restricted, then Account suspended.

Automated Process: Content screening

Trigger / Logic: Automated tools screen uploaded Content against compliance criteria (e.g. prohibited words, image checks) before and after publication.

Effect on You: Non-compliant Content may be removed or flagged for manual review without prior notice.

Automated Process: Marketing segmentation

Trigger / Logic: Behavioural and Technical Data are processed to segment users into groups for targeted content delivery. No individual profiling decisions affecting rights or access are made solely on this basis.

Effect on You: You may see Platform content relevant to your inferred interests. Opt-out via cookie/tracking settings.

Your rights

Where an automated process produces an outcome that materially affects your access to the Platform, you have the right to request human review of that decision. To do so, contact us at support@hopinhome.com, describing the automated outcome you wish to contest. We will acknowledge your request within five (5) business days and complete our review within thirty (30) days. Where a decision is reversed, we will restore access and rectify affected data promptly.

6. DATA CONTROLLER RESPONSIBILITIES FOR COMMERCIAL USERS

When HopInHome provides Listing Users with Personal Data relating to Property Seekers (e.g. enquiry contact details), the Listing User becomes an independent data controller of that data under the PDPL. As a Listing User, you must:

1. Comply fully with the PDPL and all applicable data protection laws in your handling and processing of such Personal Data;
2. Use Property Seeker Personal Data solely to respond to the relevant enquiry, and not for unrelated marketing without the individual's separate consent;
3. Not disclose such Personal Data to any third party without a lawful basis;
4. Implement appropriate technical and organisational security measures; and
5. Warrant that any Personal Data you provide to HopInHome (directly or indirectly) has been collected with a lawful basis and, where required under the PDPL, with the individual's consent to processing, use, storage, and transfer for Platform purposes.

7. WHO WE SHARE YOUR PERSONAL DATA WITH

Recipient — Purpose and Basis

Other Platform users — Contact and listing information is shared to facilitate introductions between Listing Users and Property Seekers. By publishing a Listing, you acknowledge certain information is publicly visible and may appear in third-party search engine results. PDPL Art. 4–5.

Licensed PSP — Payment processing for subscriptions and boosters. HopInHome shares only what is required for PSP processing. Raw card data is never stored or accessed by HopInHome. CBUAE regulations.

IT, cloud, and hosting providers — Platform hosting and maintenance. These providers process data only on our behalf under data processing agreements with equivalent security obligations.

Analytics and advertising partners — Platform performance analysis and targeted content delivery. Data shared is typically aggregated or pseudonymised. PDPL Art. 4.

UAE Government and regulatory authorities (DLD, RERA, DTCM, ADREC, ICP, CBUAE) — Disclosure where required by Applicable Law, court order, or regulatory request, including for AML/DNFBP and real estate compliance purposes. PDPL Art. 4.

Professional advisers — Legal, audit, insurance, and financial advisers who require limited access in connection with services provided to HopInHome, subject to professional confidentiality.

Business successors — In the event of a merger, acquisition, or business sale, Personal Data may be transferred to the successor entity subject to equivalent privacy protections. You will be notified where required by the PDPL.

Third-party communication service providers (including Meta Platforms, Inc. / WhatsApp) — Where you submit an enquiry, your contact details may be transmitted to the relevant Listing User via WhatsApp or other third-party messaging services. See Section 12 of the Terms of Use. These providers operate under their own privacy policies.

Mobile platform providers (Apple / Google) — Crash reports, performance diagnostics, and app review data as required by applicable app store policies and terms.

8. INTERNATIONAL DATA TRANSFERS

Personal Data is primarily stored and processed within the UAE. Where service providers are located outside the UAE, transfers occur only with appropriate safeguards in accordance with PDPL Art. 22, including contractual protections with the receiving party. Contact us at support@hopinhome.com for further information about international transfer safeguards.

9. HOW WE KEEP YOUR PERSONAL DATA SECURE

HopInHome implements appropriate technical and organisational measures including:

1. Encryption of data in transit (TLS/SSL) and at rest;
2. Access controls restricting data access to authorised personnel on a need-to-know basis, subject to confidentiality obligations;
3. Regular security assessments and vulnerability monitoring;
4. Data processing agreements with all third-party processors; and
5. Documented incident response procedures.

In the event of a Personal Data breach likely to cause risk to your rights, HopInHome will take prompt steps to contain the breach and notify you and the relevant authority as required by the PDPL.

10. HOW LONG WE STORE YOUR PERSONAL DATA

Data Category: Account and identity data

Retention Period: Duration of Account + 5 years post-closure

Reason: Contractual obligations; legal claims

Data Category: Permit/licence reference numbers and expiry dates

Retention Period: Duration of Account + period required by applicable regulatory obligations

Reason: RERA, DLD, DTCM, and other regulatory compliance

Data Category: Listing data

Retention Period: Duration of active Listing + 3 years

Reason: Compliance; dispute resolution

Data Category: Payment records (PSP tokens, invoices)

Retention Period: Minimum 5 years from transaction date

Reason: UAE financial record-keeping; VAT compliance

Data Category: Communications data

Retention Period: 3 years from date of communication

Reason: Dispute resolution; compliance

Data Category: Call recordings

Retention Period: Up to 1 year from date of recording

Reason: Quality assurance; training

Data Category: Technical and behavioural data

Retention Period: Up to 2 years from collection

Reason: Analytics; security monitoring

Data Category: Compliance declaration timestamps

Retention Period: Duration of Account + 5 years

Reason: Platform liability; PDPL Art. 4–6 audit trail

Data Category: Device & App Data

Retention Period: Up to 12 months from collection

Reason: App stability; security monitoring

11. YOUR RIGHTS UNDER THE PDPL

Subject to the PDPL and Applicable Law, you have the following rights in relation to your Personal Data:

Right — What It Means

Access (PDPL Art. 16) — Request a copy of the Personal Data we hold about you and information about how we process it.

Rectification (PDPL Art. 17) — Ask us to correct inaccurate or incomplete Personal Data.

Erasure (PDPL Art. 18) — Request deletion of your Personal Data where we no longer have a lawful basis for processing it, subject to legal retention obligations.

Object (PDPL Art. 19) — Object to processing based on legitimate interests. We will cease unless we can demonstrate compelling grounds.

Withdraw Consent (PDPL Art. 6) — Withdraw consent at any time where we process on the basis of consent. Withdrawal does not affect prior lawful processing.

Data Portability (PDPL Art. 20) — Request a portable copy of your Personal Data in a structured, machine-readable format, where technically feasible.

Restrict Processing — Ask us to temporarily restrict processing while a dispute about accuracy or lawfulness is resolved.

Human Review of Automated Decisions — Request human review of any automated decision that materially affects your access to the Platform. See Section 5 for full details of automated processes in use.

To exercise any right, contact us at support@hopinhome.com. We will verify your identity and respond within 30 days (extendable to 90 days for complex requests). If you are not satisfied with our response, you may lodge a complaint with the UAE data protection authority.

12. COOKIES AND TRACKING TECHNOLOGIES

HopInHome and our analytics and advertising partners use cookies and similar tracking technologies on the web Platform for: essential Platform functionality; user preference settings; analytics and performance monitoring; advertising and personalisation; and fraud prevention. You may manage your cookie preferences via your browser settings or the cookie settings available on the Platform. Disabling certain cookies may affect Platform functionality. For full details of the cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy available at www.hopinhome.com/cookie-policy.

Our mobile applications may use equivalent device-level tracking technologies (e.g. advertising identifiers such as IDFA on iOS and GAID on Android). You may opt out or reset these identifiers via your device privacy settings.

You must not use tracking data collected through the Platform to retarget Platform users outside the Platform without our prior written consent.

13. MARKETING COMMUNICATIONS

We send marketing communications only where you have opted in (PDPL Art. 4–6: Consent). You may withdraw consent at any time by: (a) clicking "Unsubscribe" in any marketing email; (b) updating account settings; (c) disabling push notifications in your device or app settings; or (d) emailing support@hopinhome.com. Withdrawal does not affect receipt of service-related communications (e.g. Account notifications, Listing status updates, payment confirmations, compliance alerts).

14. OUR POLICY ON MINORS

The Platform is not directed at individuals under 18. We do not knowingly collect Personal Data from minors. If you believe a minor has submitted data via the Platform, contact us at support@hopinhome.com and we will delete such data promptly.

15. SPECIAL CATEGORIES OF PERSONAL DATA

We do not intentionally collect special categories of sensitive Personal Data (e.g. racial or ethnic origin, religious beliefs, health information, biometric data, criminal records). We advise you not to submit such data. If you do, you consent to its processing solely to the extent necessary to respond to your communication.

16. THIRD-PARTY LINKS AND INTEGRATIONS

The Platform may contain links to third-party websites or integrate with third-party services (including mapping services, payment gateways, and analytics providers). This Privacy Policy applies only to HopInHome Platform. We are not responsible for the privacy practices of third-party websites or services. Information on our Platform does not constitute legal, financial, or real estate advice.

17. DATA PROTECTION OFFICER

HopInHome has assessed its processing activities against the criteria for mandatory Data Protection Officer ("DPO") appointment under the UAE PDPL and applicable implementing regulations.

HopInHome has designated a responsible individual to manage privacy and data protection compliance. All privacy-related enquiries, data subject rights requests, and regulatory correspondence should be directed to:

Contact Point — Details

Role — Data Protection Compliance Contact

Email — support@hopinhome.com

Postal address — HopInHome LLC, c/o HopInHome L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE

Response timeline — Within 5 business days of receipt; substantive response within 30 days (extendable to 90 days for complex requests in accordance with the PDPL)

Where regulatory developments or a material change in HopInHome processing activities require the formal appointment and registration of a DPO under the PDPL, HopInHome will make that appointment, notify the competent supervisory authority, and update this Policy accordingly.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy at any time. Any revised version will be published on this page and in the app and takes effect immediately. Where required by the PDPL or where a change is material, we will notify you by email, push notification, or Platform notice. Continued use of the Platform constitutes acceptance of the revised Privacy Policy.