Legal document
Ecosystem estate app icon

Ecosystem estate Privacy Policy

Privacy Policy · Dubai, UAE. This document describes what personal data we collect, why we collect it, and how we protect it.

Effective from: January 1, 2026

This Privacy Policy (hereinafter —"Policy") описывает порядок сбора, хранения, обработки, передачи и защиты персональных данных пользователей сайта ecosystem.estate (далее — "Website") and the associated Telegram-based services of the ECOSYSTEM (hereinafter —"Service").

This document has been prepared in accordance with the requirements of:

  • UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL);
  • Regulation EU 2016/679, the General Data Protection Regulation (GDPR);
  • Federal Law of the Russian Federation No. 152-FZ of 27.07.2006 "On Personal Data";
  • Regulations of the Dubai Land Department (DLD) and RERA regarding broker professional confidentiality.

1. Data Controller

The Data Controller (as defined under GDPR / Data Controller under PDPL) is:

  • Operator:ECOSYSTEM is a private real estate analytics platform covering Dubai.
  • Professional license: RERA Licensed.
  • Jurisdiction:Emirate of Dubai, United Arab Emirates.
  • Contact: Lead Bot.

If you have any questions, complaints, or wish to exercise your data subject rights, please reach out using the contact details above. We respond within 30 calendar days.

2. What Data We Collect

Depending on how you interact with the Service, we may process the following:

2.1. Data you provide directly

  • First name, last name (or Telegram username);
  • Phone number (including WhatsApp)
  • Email;
  • Telegram ID, username, interface language;
  • Property search criteria: budget, area, property type, number of bedrooms, purchase purpose (investment / end use / Golden Visa);
  • Messages sent to us via website forms, WhatsApp, email, or Telegram.

2.2. Automatically Collected Data

  • IP address, country, and approximate region (based on IP);
  • Information about your browser, operating system, and device type;
  • Referral source, UTM parameters;
  • On-site behavior: pages visited, time on page, clicks, and events;
  • Cookies and similar technologies (localStorage, sessionStorage) — see Section 8.

2.3. Third-party data

We may receive anonymized aggregates from publicly available sources including the Dubai Land Department (DLD), Dubai Pulse, and similar government platforms. This data is not linked to you personally and is used solely for market analytics.

2.4. Data We Do NOT Collect

  • Passport details, Emirates ID, and banking information are not requested at the preliminary consultation stage. These are shared directly with the developer, bank, or notary at the point of completing a transaction.
  • Biometric data;
  • Health data, political opinions, religious beliefs, or sexual orientation (special categories under GDPR Art. 9 / sensitive data under Federal Law No. 152-FZ, Art. 10);
  • Data relating to minors — the Service is not intended for persons under the age of 18 (see Section 10).

3. Purposes of Processing

  1. Property Search and Selection— analyzing your filters and preparing a personalized selection from our listings and project database;
  2. Client Communication— responding to inquiries, sending proposals, coordinating viewings and meetings;
  3. Transaction support— sharing agreed data with the developer / seller / notary / legal counsel;
  4. Marketing communications— newsletters on new projects, market analytics, and promotions (only with your separate consent, with an unsubscribe option in every message);
  5. Service security— protection against fraud, spam, and automated attacks; access log maintenance;
  6. Analytics and Product Improvement— anonymized traffic statistics (only when the "Analytics" category is enabled in the cookie banner);
  7. Compliance with Applicable Law— compliance with DLD, RERA, AML/CFT requirements, and UAE tax authorities.

4. Legal Grounds for Data Processing

Depending on the applicable jurisdiction and the specific operation, we rely on the following legal bases:

  • Data subject consent(GDPR Art. 6(1)(a); Federal Law No. 152-FZ, Art. 9; PDPL Art. 4) — for marketing communications and non-essential cookies;
  • Performance of a contract or pre-contractual steps(GDPR Art. 6(1)(b); PDPL Art. 5(2)) — for property search and transaction support;
  • Legitimate Interests of the Controller(GDPR Art. 6(1)(f)) — for core analytics, security, and fraud prevention;
  • Compliance with Applicable Law(GDPR Art. 6(1)(c); PDPL Art. 5(4)) — DLD/RERA reporting and UAE tax compliance.

5. Retention Period

  • Contact details and search preferences— until consent is withdrawn, or for 5 years from the last activity (the standard UAE retention period for commercial communications);
  • Completed transaction data— 7 years from the date of the last transaction (as required by UAE AML/CFT regulations);
  • Marketing consents— until withdrawn;
  • Access logs and cookies— up to 12 months;
  • Anonymized analytics— indefinitely (cannot be used to identify you).

Once the retention period expires, data is deleted or anonymized. You have the right to request early deletion (see Section 7).

6. Sharing Data with Third Parties

We do not sell your data. It is shared only to the extent required to deliver the service, and only with the following categories of recipients:

  • Telegram platform (Telegram FZ-LLC, Dubai)— when using our services, you interact with Telegram's infrastructure, which processes messages in accordance with its own privacy policy;
  • Hosting and infrastructure:Vercel Inc. (US/EU, data centers selected automatically), Railway Corp. (US), managed PostgreSQL databases;
  • Analytics(with consent only): Google Analytics 4, PostHog, Hotjar — standard DPA agreements are in place;
  • Messengers:WhatsApp (Meta Platforms Ireland Ltd.) — when communicating via WhatsApp Business;
  • Transaction partners:Dubai developers, real estate agencies, lawyers, notaries, and banks — only upon your explicit consent for a specific transaction and strictly to the extent necessary;
  • Government authoritiesUAE, EU, Russia — in cases expressly provided for by applicable law.

6.1. Cross-Border Data Transfer

As the Service infrastructure is distributed, your data may be transferred to and stored outside the UAE, Russia, and the EU — including on servers located in the United States and Europe. All such transfers are carried out on the basis of:

  • standard contractual clauses (Standard Contractual Clauses) with service providers;
  • your explicit consent given when using the Service (PDPL Art. 23; GDPR Art. 49(1)(a); Federal Law No. 152-FZ, Art. 12);
  • the necessity of performing a contract with you.

We select providers that comply with recognized international security standards (ISO 27001, SOC 2 Type II).

7. Your Rights

Depending on the applicable jurisdiction, you have the following rights:

  • Access— obtain a copy of your data that we store;
  • Correction— request correction of inaccurate data;
  • Deletion("right to be forgotten", GDPR Art. 17; PDPL Art. 14; Federal Law No. 152 Art. 14) — where no lawful basis for further retention exists;
  • Restriction of processing— suspend processing in disputed cases;
  • Portability(GDPR Art. 20) — receive your data in a machine-readable format;
  • Objectionagainst processing based on legitimate interest or for direct marketing purposes;
  • Withdrawal of Consentat any time (withdrawal does not affect the lawfulness of processing carried out prior to withdrawal);
  • Filing a Complaintto a supervisory authority: the UAE Data Office (UAE), any Data Protection Authority of an EU member state, or Roskomnadzor (Russian Federation).

Чтобы воспользоваться правом — заполните data request form или напишите в Lead Bot. We may request identity verification to prevent disclosure of personal data to unauthorized parties. Response time — up to 30 days.

8. Cookies and Similar Technologies

We use cookies and localStorage for the following purposes:

  • Required— website functionality, language preferences, session security. No consent required (PDPL Art. 6; ePrivacy Directive Art. 5(3));
  • Analytics— traffic and behavior analytics. With consent only;
  • Marketing— retargeting and personalization. With consent only.

Consent management is available via the cookie banner on your first visit and by clearing your browser's localStorage (keyvr_consent_v1). Disabling cookies in your browser may affect certain features of the Site.

9. Security

We apply reasonable technical and organizational measures:

  • data transmission encryption (HTTPS / TLS 1.2+);
  • storing passwords as cryptographic hashes;
  • restricting employee access on a need-to-know / least-privilege basis;
  • regular dependency updates and vulnerability patching;
  • backup and recovery.

That said, no online service can guarantee absolute security. In the event of a significant incident affecting your data, we will notify you within 72 hours of discovery (GDPR Art. 33; PDPL Art. 9).

10. Children

The Service is intended exclusively for individuals aged 18 and over. We do not knowingly collect data from minors. If you become aware that a child has submitted their data to us, please contact us atLead Bot, and we will delete it as soon as possible.

11. Policy Changes

We may update this Policy from time to time. Material changes will be posted on this page at least30 calendar daysprior to the effective date; where an email address is on file, a separate notification will also be sent. Continued use of the Service after the changes take effect constitutes acceptance of the revised terms.

12. Data Protection Contacts

English summary

This Privacy Policy describes how ECOSYSTEM (RERA Licensed), operating the ECOSYSTEM website and Telegram ecosystem, collects and processes personal data of its users. The document is compliant with UAE Federal Decree-Law No. 45 of 2021 (PDPL), EU GDPR and Russian Federal Law No. 152-FZ.

We collect contact details (name, phone, email, Telegram ID), search preferences, technical data (IP, browser, device), and cookies — only with your explicit consent for non-essential categories. Data is used to deliver real-estate matching services, communicate with you, complete transactions, and (with consent) for marketing and analytics. We do not sell your data; processors include Telegram FZ-LLC, Vercel Inc., Railway Corp., Google Analytics, PostHog, and developers / agencies involved in a transaction you initiate.

You have the right to access, rectify, erase, restrict, port and object to processing of your data, and to withdraw consent at any time. To exercise your rights please contact our Lead Bot or use the data request form. You may also lodge a complaint with the UAE Data Office, an EU supervisory authority, or Roskomnadzor (RF).

Questions about this document?

Write to Lead Bot — we respond within 30 days (UAE PDPL) or 30 days (GDPR Art. 12).

AI Assistant