Privacy Policy

I am Najeeb Zakri (“I”, “me”, or “my”), an individual real-estate advisory practitioner based in the Emirate of Dubai, United Arab Emirates, and reachable at zakri.ae. I act, on my own account, as the controller of the personal data described in this policy.

This policy applies to personal data I process through my website, my private portfolio application, my intake and mandate forms, and my advisory relationships. It should be read together with my Terms of Service and my Cookie Policy.

I collect only what I need to respond to you and to provide a considered advisory service. Depending on how you engage with me, this may include:

• Identity data — your name, nationality, and, where a transaction requires it, identity-verification documentation.
• Contact data — email address, telephone number, and the jurisdiction from which you are reaching out.
• Mandate & intake data — the information you provide when you build a mandate, including your investor profile, capital available to deploy, target return, intended hold horizon, budget, and property preferences.
• Usage & analytics data — how you interact with the site, such as pages viewed, approximate location derived from your IP address, device and browser type, and referring source.
• Cookies & local storage — as described in my Cookie Policy, including mandate progress saved in your browser.

I do not knowingly collect special categories of data, and I ask that you do not send me sensitive information that is not relevant to a mandate.

I use personal data to:

• respond to your enquiries and correspond with you;
• build, underwrite, and assess mandates, and provide real-estate advisory services;
• operate, secure, and improve my website and private portfolio application;
• send service communications and, where you have agreed, occasional updates relevant to your mandate; and
• comply with my legal, regulatory, and record-keeping obligations.

I process personal data on the lawful bases recognised under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). Depending on the activity, this includes your consent; the necessity of processing to take steps at your request before, or to perform, a mandate; my legitimate interest in operating and developing my practice in a way that does not override your rights; and compliance with a legal obligation. Where I rely on consent, you may withdraw it at any time, as described in Section 9.

I do not sell personal data. I share it only where necessary, and subject to appropriate confidentiality and data-protection commitments, with:

• Service providers — hosting, analytics, communications, and IT vendors who process data on my instructions;
• Developers & brokers — where introducing or progressing a specific transaction reasonably requires it, and with your knowledge;
• Regulators & authorities — including the Dubai Land Department and other competent bodies, where required by law;
• Professional advisers — such as legal, tax, and accounting advisers, where appropriate.

My clients are based across five continents, and the parties involved in a transaction may sit in different jurisdictions. Where I transfer personal data outside the UAE, I do so in accordance with the PDPL and apply appropriate safeguards — such as transfers to jurisdictions recognised as providing an adequate level of protection, or contractual protections with the recipient — to keep your data protected to a comparable standard.

I keep personal data only for as long as needed for the purposes set out in this policy, including to provide my services, maintain my records, resolve disputes, and meet legal, regulatory, and tax requirements. When data is no longer needed, I delete it or irreversibly anonymise it.

I maintain administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration — including access controls, encryption in transit where appropriate, and limiting access to those who need it. No system is completely secure, but I work to keep my safeguards aligned with the sensitivity of the data I hold.

Subject to the conditions and exceptions in the PDPL, you have the right to:

• access the personal data I hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your data;
• request restriction of, or object to, certain processing;
• request portability of data you provided to me, in a structured format;
• withdraw consent where I rely on it.

To exercise any of these rights, email privacy@zakri.ae. I may need to verify your identity before acting on a request, and I will respond within the timeframes the PDPL requires.

My services are intended for adults aged 18 and over. They are not directed to children, and I do not knowingly collect personal data from anyone under 18. If you believe a minor has provided me with personal data, please contact me so I can delete it.

Where the data-protection regime of the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM) applies to a particular relationship, I respect the requirements of that regime in addition to the PDPL.

If you have a question or concern about how I handle your personal data, please contact me at privacy@zakri.ae. I will do my best to resolve it. You also have the right to lodge a complaint with the UAE Data Office, the competent authority for the PDPL.

I may update this policy from time to time. When I do, I will revise the “last updated” date above, and material changes will be made evident on this page. Please review it periodically.