سياسة الخصوصية

This policy explains how Belgrave Estates("Belgrave", "we") collects, uses, stores and shares personal data when you use belgraveestates.com, our private-client portal, our brokers' portal, or speak to us by phone, WhatsApp, or email. It is written to satisfy the UK GDPR, the EU GDPR, the UAE Personal Data Protection Law (PDPL), the California Consumer Privacy Act (CCPA/CPRA), and equivalent frameworks in the markets we operate in.

1. Who we are

Belgrave is a luxury real-estate brokerage operating in the UAE, the UK, the wider GCC and selected European jurisdictions. The data controller for this website is Belgrave Estates. Questions about this policy, or any request relating to your personal data, can be raised through our contact page.

2. What we collect

• Account data — email, password (securely hashed; we never see or store the plaintext), name, phone, preferred language, country of residence.
• Social sign-in data — if you choose to sign in with Google or LinkedIn, we receive your basic profile from that provider: your name, email address and profile picture. We use it only to create and authenticate your account. We do not receive your password, and we do not access any other data from your provider account.
• KYC data — passport / national-ID image, proof of address, source-of-funds declaration. Encrypted at rest with envelope encryption; readable only by Belgrave compliance staff.
• Transaction data — properties you viewed, saved, enquired about; offers made; viewings booked.
• Communication data — emails, WhatsApp messages, call recordings (only where you have been told the call is recorded; jurisdiction-dependent).
• Device + telemetry — IP address, browser fingerprint hash, traceparent, device cookie, page interactions. Used for fraud prevention, security, and product improvement. Never sold.

2a. Google user data ("Sign in with Google")

When you choose Sign in with Google, Google shares a limited part of your Google profile with us: your name, email address, and profile picture. We use this data for one purpose only — to create your Belgrave Estates account, authenticate you when you sign in, and identify you within your account. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties except as needed to provide this sign-in feature or where required by law.

Belgrave Estates' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke our access to your Google account at any time from your Google Account permissions, and deleting your Belgrave Estates account also deletes the data we received through Google sign-in (see §6).

3. Why we collect it

Each purpose maps to a UK/EU GDPR lawful basis:

• Contract performance — to broker your transaction, we must know who you are and what you want.
• Legal obligation — AML / KYC record-keeping (UK MLR 2017, EU AMLD, equivalent regional rules).
• Legitimate interest — security, fraud prevention, product improvement. Balancing test on file; you may object.
• Consent — analytics + marketing cookies, marketing emails, promotional WhatsApp. You can withdraw at any time via your preferences page or by adjusting your cookie preferences.

4. Who we share it with

Belgrave operates as a private partnership and brokers transactions on your behalf. Your data is shared only with:

• The Belgrave advisors assigned to your account.
• External partner brokers, only when we introduce them to you at your request. Each such introduction is consented to on a per-property basis.
• Conveyancing solicitors, mortgage providers, surveyors — only when you have engaged them for a transaction.
• Regulators + tax authorities, where legally compelled.
• Sub-processors who provide the technical infrastructure and services that operate this platform (for example hosting, database, search and identity services). All are engaged under written data-processing agreements; a current list is available on request.

We never sell your data. We never share it with advertising networks. Marketing cookies (if you opt in) are first-party, on our own measurement infrastructure; we do not use third-party trackers for re-marketing.

5. How long we keep it

• Account data: while your account is active + 7 years after closure (UK MLR record-keeping).
• KYC data: 7 years after the last transaction (or longer where local regulators require it).
• Transaction data: 7 years.
• Communication data: 12 months (24 months for closed transactions).
• Telemetry / device data: 12 months by default; short-lived security and risk signals are retained for a limited period and then deleted.

6. Your rights

Under UK / EU GDPR you have the right to access, rectify, port, delete, restrict, and object to the processing of your personal data, plus the right not to be subject to purely automated decisions. UAE PDPL and California residents have similar (not identical) rights. Exercise any of these through your account preferences or via our contact page.

Deleting your account and data. You can delete your account and associated personal data at any time from your account preferences, or by requesting deletion through our contact page. On deletion we remove your personal data, except where we are legally required to retain certain records (for example anti-money-laundering record-keeping). Data received through social sign-in (Google or LinkedIn) is deleted together with your account.

We respond within 30 days. Identity verification is required — we will not act on a deletion request unless we can confirm the request comes from the data subject.

7. International transfers

Belgrave operates in multiple jurisdictions. When we move data between them (e.g. a UK-resident client engaging on a Dubai listing), we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or equivalent transfer mechanisms. We never transfer KYC data to a jurisdiction with weaker statutory protection than its origin.

8. Security

• Passwords stored only as hashes inside our identity provider; multi-factor authentication available for every account.
• KYC documents and other sensitive fields are envelope-encrypted with per-category keys held in a hardware-backed secret store; no Belgrave engineer has direct access.
• All admin actions on customer accounts are logged with operator identity + step-up MFA + reasoned audit trail.
• Annual penetration tests; documented disaster-recovery procedures with monthly rehearsal.

9. AI features

We offer an AI-powered concierge (via the Model Context Protocol). To prevent leakage of personal data into AI providers, the AI is permitted to browse listings and generate links to our booking / enquiry / call-back forms — but it cannot collect your name, email, or phone in chat. All contact details are captured on belgraveestates.com under your own session, with cookie consent and CSRF protection in place.

10. Changes to this policy

Material updates trigger a banner the next time you sign in. The effective date at the top of this page is authoritative. Previous versions are kept in our document archive — request a copy at any time.

11. Complaints

If you believe we have mishandled your data, please raise it with our privacy team first through our contact page. You also have the right to complain to the supervisory authority in your country — in the UAE, the UAE Data Office (under the Personal Data Protection Law); in the UK, the Information Commissioner's Office; and in the EU, your national data-protection authority.