← Leadora

Draft for legal review. This document is a starting template and is not legal advice. Placeholders in [brackets] must be completed and the text reviewed by a UAE‑qualified lawyer before use.

Effective 13 July 2026

Privacy Policy

This Privacy Policy explains how [Company Legal Name] ("we", "us"), the provider of the Leadora platform (the "Service"), handles personal data. It is designed to align with the UAE Federal Decree‑Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and its implementing regulations.

1. Our two roles

We handle personal data in two distinct capacities:

  • As a controller — for data about our own users and customers (e.g. account holders, billing contacts, website visitors). This policy governs that processing.
  • As a processor — for the lead and contact data that our customers (real‑estate brokerages) load into their workspaces. For that data, the customer is the controller and decides how it is used; we process it only on the customer's instructions under our [Data Processing Agreement](/legal/dpa). If you are a lead or contact of a brokerage, please contact that brokerage to exercise your rights.

2. Personal data we collect (as controller)

  • Account data: name, work email, username, role, and organisation.
  • Billing data: organisation name, billing contact, plan, and payment records. Card details, if any, are handled by our payment provider, not stored by us.
  • Usage and device data: log data, IP address, browser/device information, and actions taken in the Service, used for security, troubleshooting, and improving the product.
  • Communications: messages you send us for support or sales.

3. How and why we use it, and our legal bases

We process personal data to:

  • provide, secure, and support the Service (performance of our contract with you);
  • authenticate users and prevent fraud or abuse (legitimate interests / legal obligation);
  • bill and collect fees and meet tax and accounting obligations (legal obligation);
  • communicate about the Service, including service and security notices (contract / legitimate interests);
  • improve and develop the Service using aggregated or de‑identified data (legitimate interests).

We do not sell personal data.

4. Sharing and sub‑processors

We share personal data only as needed to run the Service, with:

  • Hosting and infrastructure providers that store and run the platform;
  • Communications and integration providers that a customer connects (e.g. WhatsApp/Meta, Twilio, email/SMTP, property portals) — used to deliver the customer's own messages and capture leads;
  • Professional advisers, payment and accounting providers; and
  • Authorities, where required by law.

A current list of sub‑processors is available on request. We require sub‑processors to protect personal data under written terms.

5. International transfers and data residency

The Service may be hosted or processed outside the UAE. Where personal data is transferred across borders, we take steps consistent with the PDPL to ensure an adequate level of protection, including appropriate contractual safeguards. Customers with data‑residency requirements should contact us before onboarding to discuss available options.

6. Retention

We keep personal data for as long as needed to provide the Service and for legitimate business, legal, tax, and accounting purposes. Customer Data processed on a customer's behalf is retained per the customer's instructions and our agreement; on account closure it may be exported and is then deleted in the ordinary course, subject to legal retention requirements.

7. Security

We use technical and organisational measures appropriate to the risk, including encryption of integration credentials at rest, encrypted transport (TLS), role‑based access control, tenant data isolation, audit logging, and regular backups. No system is perfectly secure, but we work to protect personal data and to notify affected parties and authorities of qualifying breaches as required by the PDPL.

8. Your rights under the PDPL

Subject to conditions and exceptions in the law, you may have the right to:

  • access the personal data we hold about you and obtain information about its processing;
  • request correction of inaccurate or incomplete data;
  • request erasure of your data;
  • restrict or object to certain processing;
  • request portability of data you provided; and
  • withdraw consent where processing is based on consent.

To exercise these rights, contact us using the details below. If you are a lead or contact within a brokerage's workspace, please contact that brokerage (the controller).

9. Cookies

The Service uses strictly necessary cookies for authentication and security. We do not use advertising cookies within the application. Our public website may use limited analytics; where required, we will seek consent.

10. Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal data from children.

11. Changes

We may update this policy from time to time. Material changes will be notified through the Service or by email. The "last updated" date below reflects the current version.

12. Contact

Data protection enquiries: privacy@leadora.ae · [Company Legal Name], [Registered Address], [Free Zone / Emirate], UAE. If you have a concern we cannot resolve, you may contact the UAE Data Office.