GoldenKey Real Estate Buying & Selling Brokerage L.L.C (“Company”, “We”, “Us”, or “Our”) is committed to protecting the privacy and personal data of individuals who interact with our services. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you visit our website, interact with our digital advertisements, submit enquiries through lead generation forms, or use our services. This Privacy Policy also governs data collected through our advertising activities on third party platforms including, but not limited to, Meta Platforms (Facebook, Instagram, Messenger), Google Ads, and other digital marketing channels. By accessing or using our website and services, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will obtain your explicit consent before processing your personal data.

1. Data Controller

The data controller responsible for your personal data is: GoldenKey Real Estate Buying & Selling Brokerage L.L.C License No. 1571927 | RERA Registered Broker Office 2705, Business Bay, Dubai, United Arab Emirates Phone: +971-45651830 Website: www.goldenkeydxb.com

2. Regulatory Compliance

GoldenKey Real Estate operates as a licensed real estate brokerage under the Dubai Department of Economy and Tourism (DET), with activities regulated by the Real Estate Regulatory Agency (RERA) and the Dubai Land Department (DLD). Our brokerage activities are registered under License No. 1571927 with active permits for Real Estate Buying & Selling Brokerage and Leasing Property Brokerage. All advertising conducted by the Company, including digital advertising on Meta Platforms, Google, and other channels, complies with RERA advertising regulations. Our advertisements display the required broker credentials, RERA registration number, and agency permit details as mandated by Dubai Land Department guidelines. We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations.

3. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below: Personal Data: Any information that relates to an identified or identifiable natural person, including but not limited to name, email address, phone number, IP address, device identifiers, and online behavioural data. Processing: Any operation performed on personal data, whether automated or manual, including collection, recording, storage, use, disclosure, profiling, and deletion. Data Subject: The individual whose personal data is being processed (referred to as “You” in this Policy). Service: Refers to the website, landing pages, lead generation forms, and all related real estate brokerage services provided by the Company. Service Provider: Third-party companies or individuals engaged by the Company to facilitate, provide, or perform services on our behalf, including advertising and analytics platforms. Usage Data: Information collected automatically through the use of the Service, such as IP address, browser type, pages visited, and device identifiers. Cookies: Small data files stored on your device by our website to enhance functionality, analyse usage, and support marketing and remarketing activities. Pixel/Tracking Tag: A small piece of code placed on our website or landing pages by third party platforms (such as Meta Pixel or Google Ads tags) that collects data about visitor behaviour for advertising measurement and optimisation. Remarketing/Retargeting: The practice of showing targeted advertisements to individuals who have previously visited our website or interacted with our content, using data collected via tracking technologies. Lead Ad: An advertisement format on platforms such as Meta (Facebook/Instagram) that allows users to submit their contact information directly within the ad without leaving the platform. Special Ad Category (HEC): A designation required by Meta and Google for advertisements related to Housing, Employment, and Credit, which imposes specific restrictions on audience targeting to prevent discrimination.

4. Legal Basis for Processing

In accordance with the UAE PDPL and relevant international data protection frameworks, we process your personal data based on one or more of the following legal grounds:

• Consent: Where you have provided clear, informed, and specific consent to the processing of your personal data for one or more specific purposes, including consent for advertising and marketing communications.
• Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g., responding to property inquiries, facilitating viewings or transactions).
• Legitimate Interest: Where processing is necessary for our legitimate business interests, such as improving our services, website analytics, and advertising performance measurement, provided such interests do not override your fundamental rights and freedoms.
• Legal Obligation: Where processing is necessary to comply with applicable laws, regulations, or court orders in the UAE.

5. Types of Data Collected

5.1 Personal Data

When you interact with our website, advertisements, or services, we may collect the following personal data:

• First name and last name
• Email address
• Phone number (including WhatsApp)
• Nationality and residency status (where relevant to property transactions)
• Information submitted through property inquiry forms, contact forms, or callback requests
• Information submitted through lead generation forms on Meta (Facebook/Instagram), Google, or other advertising platforms

5.2 Real Estate Inquiry Data

We collect personal information when you:

• Submit property inquiry or viewing request forms on our website or through ad platform lead forms
• Request property details, brochures, or floor plans
• Request a callback from our team
• Subscribe to property updates or newsletters
• Contact us regarding real estate brokerage services
• Interact with our advertisements on Meta, Google, or other platforms

5.3 Usage Data

Usage Data is collected automatically when you access our website. This may include:

• IP address and approximate geolocation
• Browser type, version, and language preferences
• Pages visited, referring URLs, and navigation paths
• Date, time, and duration of visits
• Device type, operating system, and unique device identifiers
• Advertising identifiers (e.g., Google Advertising ID, Apple IDFA)

5.4 Data Collected via

Advertising Technologies When you interact with our advertisements or visit our website after clicking on an ad, third party advertising platforms may collect additional data through their tracking technologies. This includes:

• Ad interaction data (impressions, clicks, video views)
• Conversion events (form submissions, page views, button clicks)
• Cross-device and cross-platform browsing behaviour
• Audience segment and interest category data derived from your online activity
• Data submitted through platform-hosted lead generation forms

The specific data collected depends on the platform and your privacy settings on that platform. Please refer to Section 6 for details on each advertising technology we use.

6. Advertising and Remarketing Technologies

We use third-party advertising platforms and tracking technologies to deliver relevant advertisements, measure campaign performance, and optimise our marketing efforts. This section discloses the specific technologies we use, the data they collect, and how you can manage your preferences.By using our website, you acknowledge that these third-party vendors, including Meta and Google, use cookies, pixels, and similar technologies to collect and receive information from our website and elsewhere on the internet. This information is used to provide measurement services, target and deliver advertisements, and build audience segments. By using our website, you acknowledge that these third-party vendors, including Meta and Google, use cookies, pixels, and similar technologies to collect and receive information from our website and elsewhere on the internet. This information is used to provide measurement services, target and deliver advertisements, and build audience segments.

6.1 Meta Pixel and Meta Conversions API

Our website uses the Meta Pixel, a piece of JavaScript code provided by Meta Platforms, Inc. The Meta Pixel collects data about visitor activity on our website and transmits it to Meta for the following purposes:

• Measuring the effectiveness of our Facebook and Instagram advertising campaigns
• Tracking conversion events (such as lead form submissions, page views, and property inquiry completions)
• Building Custom Audiences for retargeting visitors who have previously interacted with our website
• Creating Lookalike Audiences to reach new users with similar profiles to our existing leads
• Optimising ad delivery to users most likely to take a desired action

We may also use the Meta Conversions API (CAPI), a server-to-server integration that sends conversion data directly from our server to Meta. This operates alongside or independently of the Meta Pixel to improve data accuracy while reducing reliance on browser-based cookies. Data collected by Meta Pixel and CAPI may include: pages visited, time spent on pages, actions taken (such as form submissions), device and browser information, IP address, and Facebook cookie data. This data is processed by Meta in accordance with the Meta Privacy Policy. To manage your Meta advertising preferences or opt out, visit:www.facebook.com/adpreferences.

6.2 Google Ads and Google Analytics

Our website uses Google Ads remarketing tags and Google Analytics, provided by Google LLC. These technologies collect data about your interactions with our website for the following purposes:

• Measuring the performance of our Google Search, Display, and YouTube advertising campaigns
• Tracking conversion events (such as lead form submissions and phone calls)
• Remarketing to visitors who have previously visited our website by showing them relevant ads across the Google Display Network, Google Search, and YouTube
• Analysing website traffic, user behaviour, and engagement metrics
• Optimising ad delivery and bidding strategies

Google uses cookies (including the Google Ads cookie and the Google Analytics cookie) to serve ads based on your prior visits to our website. Third-party vendors, including Google, show our ads on sites across the Internet using this data. Google Analytics may collect demographic and interest data in aggregated form to help us understand our audience. We do not use Google Analytics to collect or store personally identifiable information beyond what is automatically collected by the platform. To opt out of personalised advertising by Google, visit: adssettings.google.com To opt out of Google Analytics tracking, install the Google Analytics Opt-Out Browser Add on: tools.google.com/dlpage/gaoptout

6.3 Other Advertising Platforms

We may also use other third-party advertising and analytics platforms from time to time, including but not limited to TikTok Ads, Snapchat Ads, LinkedIn Ads, and programmatic display advertising networks. Where such platforms are used, they may deploy their own tracking technologies (cookies, pixels, SDKs) on our website or landing pages. Each platform processes data in accordance with its own privacy policy. We encourage you to review the privacy policies of any platform through which you interact with our advertisements. 6.4 Lead Generation Forms on Advertising Platforms We run lead generation advertisements on Meta (Facebook and Instagram) and Google that allow you to submit your contact information directly within the ad platform, without visiting our website. When you submit a lead form:

• The data you provide (such as name, email, phone number) is transmitted to us and stored in our customer relationship management (CRM) system
• Your data is governed by this Privacy Policy from the point of submission
• Your data is also subject to the platform’s own privacy policy (e.g., the Meta Privacy Policy or Google Privacy Policy)
• We use this data solely for the purposes disclosed in the lead ad form, including responding to your property inquiry, sending relevant property information, and follow-up communications

We do not use data collected through lead forms for purposes other than those disclosed at the point of collection without obtaining your additional consent.

6.5 Data Source Declaration for Remarketing Audiences

In compliance with Meta’s 2026 global advertising policy and Google Ads requirements, we declare the following regarding the data sources used to build our remarketing and custom audiences:

• Website Visitors: Website visitor data collected via Meta Pixel and Google Ads remarketing tags placed on www.goldenkeydxb.com
• Customer Lists: Customer contact data (email, phone) collected through our website forms, lead generation ads, and direct inquiries, uploaded securely in hashed format
• Engagement-Based Audiences: Users who have interacted with our Facebook page, Instagram profile, or advertisements
• Lookalike/Similar Audiences: Audiences generated by Meta and Google algorithms based on the characteristics of our existing audiences (no personal data from our customer lists is shared with lookalike users)

All audience data is processed in compliance with each platform’s terms of service and applicable data protection laws. Customer list data is hashed before upload, and we maintain records of the data sources and consent basis for all custom audiences.

6.6 Special Ad Category Compliance (Housing)

As a real estate brokerage, our advertisements promoting property sales, rentals, or leasing services fall under the Housing Special Ad Category (HEC) on both Meta and Google Ads. This means:

• Our housing-related ads are run with Special Ad Category restrictions enabled
• We do not use demographic targeting (age, gender, postcode/ZIP code) in ways that could result in discriminatory advertising practices for housing ads
• Detailed interest and behaviour-based targeting is limited in accordance with platform HEC policies
• We comply with all anti-discrimination requirements set by Meta, Google, and applicable UAE law

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to monitor website activity, improve our services, and support our advertising activities.

7.1 Types of Cookies Used

Essential Cookies: Required for basic website functionality, including page navigation and secure access. These cannot be disabled. Cookie Consent Cookies: Used to remember your cookie preferences and consent choices. Functionality Cookies: Used to remember your preferences and improve your browsing experience. Analytics Cookies: Used to understand website performance and user behaviour (e.g., Google Analytics). Advertising and Remarketing Cookies: Used by third-party platforms including Meta and Google to deliver targeted advertisements, measure campaign performance, track conversions, and build remarketing audiences. These include the Meta Pixel cookie, Google Ads cookie (_gcl_au), and Google Analytics cookies (_ga, _gid).

7.2 Cookie Consent

Upon your first visit, our website displays a cookie consent banner. Non-essential cookies (analytics and advertising) are only activated after you provide affirmative consent. You may withdraw your cookie consent at any time through your browser settings or our cookie preferences panel. If you decline advertising cookies, the Meta Pixel and Google Ads remarketing tags will not be activated, and your browsing data will not be shared with these platforms for advertising purposes. Essential cookies will remain active as they are necessary for the website to function.

7.3 Managing Cookies and Opting Out

You can control cookies through the following methods:

• Cookie Banner: Use our website cookie consent banner to accept or reject non essential cookies
• Browser Settings: Adjust your cookie settings in your web browser (Chrome, Safari, Firefox, Edge) to block or delete cookies
• Meta Ad Preferences: Visit facebook.com/adprefere ces
• Google Ad Settings: Visit adssettings.google.com
• Industry Opt-Out: Visit optout.aboutads.info or youronlinechoices.eu

8. Purposes of Processing

We process your personal data for the following purposes:

• To provide and maintain our website and real estate brokerage services
• To respond to property inquiries, viewing requests, and service requests received through our website, lead generation ads, or direct communication
• To manage client relationships and facilitate property transactions
• To contact you regarding property listings, investment opportunities, or services relevant to your inquiry
• To send marketing communications, updates, and offers (with your consent)
• To deliver targeted and personalised advertisements through Meta, Google, and other advertising platforms
• To measure and optimise advertising campaign performance
• To build and manage remarketing audiences for advertising purposes
• To improve our website, marketing campaigns, and user experience
• To analyse usage trends, website performance, and advertising effectiveness
• To comply with legal and regulatory obligations, including RERA and DLD requirements

9. Communication Consent

By submitting your contact details through our website, lead generation advertisements, or other contact channels, you expressly consent to our representatives contacting you via phone calls, email, SMS, WhatsApp, or other electronic communication methods. This communication may relate to your property inquiry, investment opportunities, or real estate services. Please note that when we communicate via WhatsApp, your data may be processed by Meta Platforms, Inc. in accordance with their own privacy policy. By opting to communicate through WhatsApp, you acknowledge this additional processing. If you interact with our Facebook page or Instagram account via Messenger or Direct Messages, you may receive automated or manual follow-up communications related to your inquiry. You may opt out of marketing communications at any time by contacting us at the details provided in Section 18 of this Policy, by using the unsubscribe mechanism in any marketing email, or by replying STOP to any SMS message.

10. Sharing Your Personal Data

We may share your personal data in the following circumstances: With Advertising Platforms: We share data with Meta Platforms (Facebook, Instagram), Google, and other advertising partners through pixels, APIs, and customer list uploads for the purposes of advertising measurement, optimisation, and audience building. Data shared with these platforms is subject to their respective privacy policies and data processing terms. With Service Providers: We share data with trusted third parties who assist in operating our website, IT infrastructure, CRM systems, email marketing platforms, and business services. These providers are contractually bound to process data only as instructed by us. With Real Estate Partners: We may share inquiry data with property developers, co brokerage partners, or related service providers who are directly involved in fulfilling your property inquiry or transaction. We will inform you at the point of collection when such sharing is intended. For Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of the business. You will be notified of any such change.For Legal Compliance: Where required by law, regulation, or legal process in the UAE, including requirements from RERA, DLD, or other regulatory authorities. With Your Consent: For any other purpose disclosed to you at the time of data collection, with your explicit consent.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. Our standard retention periods are as follows:

• Property inquiry data: Retained for up to 2 years from the date of your last interaction, unless a transaction is initiated.
• Transaction-related data: Retained for a minimum of 5 years to comply with UAE regulatory requirements.
• Marketing consent records: Retained until consent is withdrawn.
• Usage and analytics data: Retained for up to 26 months (in line with Google Analytics default retention settings).
• Advertising audience data: Custom audiences built from customer lists are refreshed periodically and source lists are deleted when no longer needed for active campaigns.

We may retain data for longer periods where required to comply with legal obligations, resolve disputes, or enforce agreements.

12. Cross-Border Data Transfers

Your personal data is primarily processed and stored within the United Arab Emirates. However, by using advertising platforms such as Meta and Google, your data may be transferred to and processed in other jurisdictions, including the United States and the European Union, where these companies maintain their servers and processing infrastructure. Where personal data is transferred outside the UAE, we ensure that appropriate safeguards are in place in accordance with the PDPL, including:

• Transfers to countries recognised as providing an adequate level of data protection
• Standard contractual clauses or equivalent data protection agreements with service providers
• Platform-specific data processing agreements (e.g., Meta Business Tools Terms, Google Ads Data Processing Terms)
• Your explicit consent where no other safeguard is available

13. Your Data Rights

Under the UAE PDPL, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing. This includes the right to withdraw consent for advertising cookies, remarketing, and marketing communications.
• Right to Opt Out of Targeted Advertising: You may opt out of having your personal data used for targeted advertising by using the opt-out mechanisms described in Section 7.3.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the UAE Data Office if you believe your data protection rights have been violated.

To exercise any of these rights, please contact us using the details in Section 18. We will respond to your request within 14 business days and may request identity verification before processing your request.

14. Security of Personal Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), access controls, secure CRM systems, and regular security reviews. Customer data uploaded to advertising platforms (e.g., for Custom Audiences) is hashed using SHA-256 encryption before transmission. We do not store unhashed customer data on any advertising platform. However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

15. Children’s Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. Our lead generation advertisements are not targeted at minors in compliance with Meta and Google advertising policies. If we discover that personal data of a minor has been collected without verifiable parental or guardian consent, we will take prompt steps to delete such data.

16. Links to Third-Party Websites

Our website and advertisements may contain links to external websites, including property developer websites, partner portals, and social media platforms. We are not responsible for the privacy practices or content of third-party websites and encourage you to review their privacy policies before providing any personal data.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, advertising platform requirements, or legal obligations. Any material changes will be posted on this page, and the “Last Updated” date will be revised accordingly. Where required by law, we will notify you of significant changes and, where necessary, seek renewed consent. We review this Privacy Policy at least annually, and following any significant changes to our advertising practices or the policies of our advertising platform partners.

18. Contact Us

concerns about how your data is being processed, or wish to opt out of advertising or marketing communications, please contact us: GoldenKey Real Estate Buying & Selling Brokerage L.L.C Office 2705, Business Bay, Dubai, United Arab Emirates Phone: +971-45651830 Website: www.goldenkeydxb.com