Privacy policy.

When you send an enquiry, request a brochure or callback, register interest in a project, share a shortlist, download a guide, ask for a valuation, book a consultation or apply for a role, we collect what you type into the form: typically your name, email address, telephone number, the subject of your enquiry and any message you write. Some forms ask for more specific information — a budget range, a preferred time, a property you own, a LinkedIn profile — and say so on the form.

Alongside every submission we record the page it was sent from, the referring website if there was one, any campaign parameters in the address (utm_source and similar), the time it was received and the browser's user-agent string. This tells us which of our pages and campaigns are useful and helps us tell a real enquiry from an automated one.

If you go on to work with an advisor we will collect what a property transaction requires: identity documents, proof of address, source-of-funds documentation, and the details of the property and the parties. These are collected for the transaction, held to the standards the Dubai Land Department sets, and never gathered through the website itself.

We use your contact details to answer the enquiry you sent and, where you have asked for it, to send the brochure, guide or valuation you requested. The legal basis is the performance of the service you asked for, or the steps needed before it.

Where you tick a consent box we use the details for what the box says — occasional listings, the monthly market note, or follow-up about a specific enquiry. Consent boxes on this site are never pre-ticked, and you can withdraw consent at any time by replying to any message or writing to us.

We use the page, referrer and campaign information under our legitimate interest in understanding how the website is used and in protecting it from abuse. We do not use it to build a profile of you and we do not sell it.

Transaction records are kept because the law and the regulator require it. Anti-money-laundering rules oblige us to verify identity and source of funds and to keep those records for a period after the transaction; we cannot waive this on request.

Your details are seen by the OAC18 advisor who handles your enquiry and by the founders. We do not pass them to other agencies, developers or marketing lists without telling you and, where the law requires it, asking first.

We use a small number of service providers to run the website and the business: hosting, email delivery, a customer database and, once enabled, analytics. Each processes data only on our instructions and under a written agreement. Some of these providers are outside the United Arab Emirates; where personal data leaves the UAE we rely on the provider's contractual commitments and on the adequacy and safeguard provisions of the PDPL.

In a transaction we share what the transaction needs with the other party's broker, the developer, the trustee office, the Dubai Land Department and, where relevant, a bank or a lawyer you have appointed. We will tell you what is being shared and why.

We will disclose personal data where a court, a regulator or the law requires it.

Enquiries and the correspondence around them are kept for two years after our last contact with you, then deleted, unless they led to a transaction or you asked us to keep in touch.

Transaction files, including identity and source-of-funds records, are kept for the period the Dubai Land Department and UAE anti-money-laundering regulations require — currently a minimum of five years from the end of the relationship — and then securely destroyed.

Marketing consents last until you withdraw them. If we have not heard from you for three years we remove you from any list rather than assume you still want to hear from us.

Under the PDPL you can ask us what personal data we hold about you and receive a copy; ask us to correct it; ask us to delete it where we no longer need it; object to or ask us to restrict certain processing; ask for your data in a portable format; and withdraw a consent you have given. Some of these rights are qualified where the law obliges us to keep a record.

To exercise any of them, write to info@oac18.com. We will confirm your identity, then respond within the period the law allows and in any case within one month. If you are unhappy with our answer you may complain to the UAE Data Office, the regulator established under the PDPL.

Form submissions travel over an encrypted connection and are stored in systems restricted to the people who need them. Identity and financial documents for a transaction are kept separately from marketing data, with access logged. Staff are trained on what they may and may not do with client information, and we review access when someone leaves.

No system is perfect. If a breach ever affected your data in a way likely to cause you harm, we would tell you and the UAE Data Office without undue delay, as the PDPL requires.

This website and our services are for adults. We do not knowingly collect personal data from anyone under eighteen, and we will delete it if we learn we have.

When we change this policy we update the date at the top of the page. If a change affects how we use data you have already given us, we will tell you directly before it takes effect.