Privacy Policy

Zakri (“Zakri”, “we”, “us”, or “our”) is a real-estate advisory practice operated by Najeeb Zakri, based in the Emirate of Dubai, United Arab Emirates, and reachable at zakri.ae. We act as the controller of the personal data described in this policy.

This policy applies to personal data we process through our website, our private portfolio application, our intake and mandate forms, and our advisory relationships. It should be read together with our Terms of Service and our Cookie Policy.

We collect only what we need to respond to you and to provide a considered advisory service. Depending on how you engage with us, this may include:

• Identity data — your name, nationality, and, where a transaction requires it, identity-verification documentation.
• Contact data — email address, telephone number, and the jurisdiction from which you are reaching out.
• Mandate & intake data — the information you provide when you build a mandate, including your investor profile, capital available to deploy, target return, intended hold horizon, budget, and property preferences.
• Usage & analytics data — how you interact with the site, such as pages viewed, approximate location derived from your IP address, device and browser type, and referring source.
• Cookies & local storage — as described in our Cookie Policy, including mandate progress saved in your browser.

We do not knowingly collect special categories of data, and we ask that you do not send us sensitive information that is not relevant to a mandate.

We use personal data to:

• respond to your enquiries and correspond with you;
• build, underwrite, and assess mandates, and provide real-estate advisory services;
• operate, secure, and improve our website and private portfolio application;
• send service communications and, where you have agreed, occasional updates relevant to your mandate; and
• comply with our legal, regulatory, and record-keeping obligations.

We process personal data on the lawful bases recognised under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). Depending on the activity, this includes your consent; the necessity of processing to take steps at your request before, or to perform, a mandate; our legitimate interest in operating and developing our practice in a way that does not override your rights; and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time, as described in Section 9.

We do not sell personal data. We share it only where necessary, and subject to appropriate confidentiality and data-protection commitments, with:

• Service providers — hosting, analytics, communications, and IT vendors who process data on our instructions;
• Developers & brokers — where introducing or progressing a specific transaction reasonably requires it, and with your knowledge;
• Regulators & authorities — including the Dubai Land Department and other competent bodies, where required by law;
• Professional advisers — such as legal, tax, and accounting advisers, where appropriate.

Our clients are based across five continents, and the parties involved in a transaction may sit in different jurisdictions. Where we transfer personal data outside the UAE, we do so in accordance with the PDPL and apply appropriate safeguards — such as transfers to jurisdictions recognised as providing an adequate level of protection, or contractual protections with the recipient — to keep your data protected to a comparable standard.

We keep personal data only for as long as needed for the purposes set out in this policy, including to provide our services, maintain our records, resolve disputes, and meet legal, regulatory, and tax requirements. When data is no longer needed, we delete it or irreversibly anonymise it.

We maintain administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration — including access controls, encryption in transit where appropriate, and limiting access to those who need it. No system is completely secure, but we work to keep our safeguards aligned with the sensitivity of the data we hold.

Subject to the conditions and exceptions in the PDPL, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your data;
• request restriction of, or object to, certain processing;
• request portability of data you provided to us, in a structured format;
• withdraw consent where we rely on it.

To exercise any of these rights, email privacy@zakri.ae. We may need to verify your identity before acting on a request, and we will respond within the timeframes the PDPL requires.

Our services are intended for adults aged 18 and over. They are not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us so we can delete it.

Where the data-protection regime of the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM) applies to a particular relationship, we respect the requirements of that regime in addition to the PDPL.

If you have a question or concern about how we handle your personal data, please contact us at privacy@zakri.ae. We will do our best to resolve it. You also have the right to lodge a complaint with the UAE Data Office, the competent authority for the PDPL.

We may update this policy from time to time. When we do, we will revise the “last updated” date above, and material changes will be made evident on this page. Please review it periodically.