Privacy Policy

Who I am and what this covers

I am Najeeb Zakri ("I", "me" or "my"), a real-estate investment advisor based in the Emirate of Dubai, United Arab Emirates. I am the controller of the personal data described in this policy, which means I decide why and how it is processed. You can reach me at najeeb@districteight.co or on +971 58 965 8602.

I practise through District Eight Real Estate LLC, a company registered in Dubai, United Arab Emirates under commercial licence number 1515729, with its registered address at Office 306, Binghatti House, Dubai, United Arab Emirates. Where this policy says "I" or "me", the controller of your personal data is that company.

This policy covers najeebzakri.com, the enquiry and registration forms on it, the client portal, and the follow-up conversations that begin there. It should be read with the Terms of Service and the Cookie Policy. It does not cover the transaction paperwork of a property purchase, which is governed by the documents you sign with the developer, the Dubai Land Department and any licensed broker involved.

The personal data I collect, form by form

I collect only what a form asks for, and every form on the site is listed here. Fields marked optional can be left empty.

• Get started and enquiry forms (on the Get started, About, What I offer, Portfolio mandates, Direct investments, Solutions, How it works, Philosophy and Financial tools pages): your name, phone number, email address, country, the amount you are considering investing, your goal and your time horizon.
• Expression of interest form (Register interest): the project you are interested in, your name, phone number, email address, country, what you are looking for, and optionally your company, budget, intended use and notes.
• Guaranteed-returns reservation form (Financial tools): your name, phone number, email address, country, the amount and the term you selected.
• Contact page, General enquiry and Feedback tabs: your name, email address and your message.
• Home-page invitation: your email address and your answers to three short questions (your goal, your preferred approach, and whether you have invested in property before). Sending it also opens WhatsApp with those answers written into a message to me, which you can edit or discard before sending.
• Account registration: your full name, email address, mobile number and a password. The password is handled entirely by Supabase Auth, stored only as a one-way hash, and is never visible to me. Registering also files an enquiry record with your name, email and number so that I can follow up personally.
• Client portal, programme interest: when you ask about a buyback or joint-venture programme from inside the portal, I receive the option you chose, the amount, term, rate and projected figures you set in the calculator, your notes, and the name, phone and email already on your account.
• Client portal, launch updates: which launches you have switched on updates for, so I know what to tell you about. Switching updates off deletes that record.

With every form submission, my server also records the date and time, your browser's identifying string (user agent), the address of the page you submitted from, and, if you were signed in, the link to your account. Nothing else is captured from your device.

The calculators and planning tools on the site run in your browser. The figures you type into them are not sent to me unless you go on to submit a form, or choose a button that opens WhatsApp with a summary already written in, which you can edit or discard before sending.

Outside the website, if we go on to work together, I may hold the identity and source-of-funds documentation that a property transaction in the UAE legally requires. That is collected directly from you at the time and is covered by the engagement letter, not by this website.

Data I do not collect

I use Vercel Web Analytics to count page views. It sets no cookies, does not follow you between sites, and records only the page, the referring site, the country, and the type of device and browser, with no name, address or identifier attached. I run no advertising tracking and no other visitor-tracking service. I do not collect payment card details through the site. I do not knowingly collect special categories of data such as health, religion or biometric data, and I ask that you do not include such information in a message. The site is not directed at children under 18, and I do not knowingly collect their data; if you believe a minor has sent me personal data, contact me and I will delete it.

Phone verification, only if it is switched on

The site contains a phone-verification step that sends a one-time code by WhatsApp (or SMS) through Twilio Verify. At the time of this policy's date it is switched off, and no form asks you for a code. If it is switched on, the code itself is generated, delivered and checked by Twilio and is never stored by me. I keep a log of each request to send or check a code, containing your phone number, your IP address, which form it came from, the time, and whether it succeeded. That log exists to limit abuse of the feature and is used for nothing else.

Why I use your data, and on what legal basis

I process personal data on the bases recognised by the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, for visitors from the EU, the UK and Switzerland, the equivalent bases in the GDPR and the UK GDPR:

• To answer your enquiry and hold the conversation you started: this is processing needed to take steps at your request before any engagement.
• To operate your account and the client portal, including showing you the positions, valuations, documents and programmes relevant to you: performance of the account terms you accepted when you registered.
• To send you an account confirmation email when you register: performance of those same terms.
• To follow up personally on an enquiry, by WhatsApp, phone or email: my legitimate interest in running an advisory practice, balanced against your interests, and you can tell me to stop at any time.
• To keep the site secure, limit abuse of public forms, and diagnose faults: my legitimate interest in running a safe service.
• To meet UAE record-keeping, anti-money-laundering and tax obligations where an engagement or transaction follows: compliance with a legal obligation.
• For anything optional, such as loading a third-party scheduler that sets cookies: your consent, which you can withdraw as described in the Cookie Policy.

I do not send automated marketing emails or newsletters, and I do not use your data for profiling or automated decision-making.

Who processes your data: the services I use

I do not sell personal data. The following providers process it on my behalf, under their standard data-processing terms, and only for the purposes described:

• Supabase: the database and the authentication service. Every form submission, every account, the portal records and client documents are stored in a Supabase project hosted in the AWS ap-south-1 region (Mumbai, India). Account confirmation emails are currently sent through Supabase's email service.
• Vercel: hosts the website and runs its server code. Vercel keeps short-lived request logs (IP address, URL, time and browser string) for operating and securing the service, and serves the site through its global edge network.
• Telegram: the moment a form is submitted, its contents are forwarded to my phone as a Telegram message from a private bot, so that I see it immediately. Telegram therefore handles a copy of what you submitted.
• Calendly: if you use the Schedule a call buttons or the calendar on the contact page, the details you enter there (name, email, chosen time and any notes) are collected by Calendly under Calendly's own privacy policy and shared with me as the meeting organiser.
• WhatsApp (Meta): several buttons open a WhatsApp chat with me with a message already written in. Anything you send there is processed by WhatsApp under its own terms and reaches me on my phone.
• Twilio: only if phone verification is switched on, Twilio Verify delivers and checks the one-time code, and receives your phone number to do so.
• Resend (planned): once a dedicated email service is configured, account and service emails will be sent through Resend instead of Supabase's email service. This policy will be updated when that happens.

Beyond these providers, I share personal data only where a transaction reasonably requires it and with your knowledge: with a developer or licensed broker to progress a specific purchase; with the Dubai Land Department or another authority where the law requires it; and with my own legal, tax or accounting advisers where appropriate.

International transfers

Because of the providers above, your data leaves the UAE. It is stored in India (Supabase), served and logged through Vercel's infrastructure in the United States and elsewhere, and copied to Telegram, and to Calendly, WhatsApp or Twilio where you use those features. Clients and counterparties may also sit in other countries.

I make these transfers under the PDPL's rules on cross-border transfer, relying on the contractual data-protection commitments each provider gives to its customers and, where the PDPL requires it, on your explicit consent, which you give when you submit a form having been directed to this policy. For visitors from the EU, the UK and Switzerland, I rely on the standard contractual clauses that these providers incorporate in their terms.

How long I keep it

There is no automated deletion on the site today, so these are the periods I apply and review:

• Enquiries and form submissions: kept while the conversation they started is live and for up to 24 months after our last contact, then deleted, unless an engagement followed, in which case they form part of the client record below.
• Accounts and portal records: kept for as long as your account exists. When you delete your account, your profile is deleted with it and associated enquiry and interest records are removed or anonymised.
• Client records for an engagement (positions, valuations, documents, correspondence): kept for the life of the engagement and afterwards for as long as UAE record-keeping, anti-money-laundering and tax law require.
• Phone-verification logs, if the feature is on: no longer than 12 months.
• Hosting request logs: retained by Vercel for a short period under its own settings and not copied by me.
• Telegram notifications: kept on my phone and deleted as part of the same review as the enquiry they duplicate.

Security

The site is served over HTTPS only. Passwords are hashed by Supabase Auth and never visible to me. Database access from the browser is restricted by row-level security, so a signed-in client can read only their own profile, their own holdings and the research published to all clients; the keys that can bypass those rules exist only on the server. Client documents such as title deeds and sale agreements sit in a private storage bucket and are released only through a link that expires sixty seconds after it is issued, and only to the account that holds the property. Administrative access is tied to named accounts rather than a shared password. No system is completely secure, and I will tell you without undue delay if a breach affects your data.

Your rights

Under the PDPL, and under the GDPR or UK GDPR if you are in the EU, the UK or Switzerland, you have the right to:

• ask for a copy of the personal data I hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict or object to processing, including objecting at any time to my contacting you about your enquiry;
• receive the data you gave me in a structured, commonly used format;
• withdraw consent where I rely on it, without affecting what was done before;
• not be subject to automated decisions with legal or similarly significant effects, which I do not make.

Deleting your account: sign in and use the delete option on your account page, and the account is removed with the consequences described under retention above. If you would rather not sign in, or you want enquiry records removed that are not tied to an account, email najeeb@districteight.co from the address you used and I will do it for you.

Stopping contact: reply to any message from me, or email me, and say stop. Launch updates inside the portal can be switched off per launch on the launch page.

For any other request, email najeeb@districteight.co. I may ask you to confirm your identity first. I will respond within one month, or sooner where the PDPL requires it.

Free-zone regimes

Where a particular relationship falls under the data-protection law of the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM), I respect the requirements of that regime in addition to the PDPL.

Complaints

If you are unhappy with how I have handled your data, write to me first at najeeb@districteight.co and I will do my best to put it right. You also have the right to complain to the UAE Data Office, the authority responsible for the PDPL, and, if you are in the EU, the UK or Switzerland, to your local data-protection authority.

Changes to this policy

I will update this policy whenever what the site collects, or who processes it, changes. The "last updated" date above shows the current version, and a material change will be flagged on this page. If you have an account, I will also tell you by email.