HOW WE COLLECT PERSONAL DATA (SOURCES OF PERSONAL DATA)

1. Directly from the individual through registration, forms, enquiries, uploads, agreements, viewings, payments, surveys, support, or privacy requests.
2. From an authorized representative, family member, employer, corporate client, landlord, lessee, tenant, guarantor, developer, referring broker, or property manager.
3. From listing portals, social media platforms and advertising channels used by the individual to contact EWIG.
4. From banks, payment processors, valuers, inspectors, maintenance providers, and transaction counterparties.
5. From identity verification, KYC, sanctions, fraud-prevention, and screening providers.
6. From public records, land/property registers, corporate registers, courts and government or regulatory authorities, where lawful.
7. Automatically from websites, the App, devices, cookies, logs, security systems, Software Development Kit (SDK), and analytics tools.

PURPOSES AND LAWFUL GROUNDS

EWIG will not process personal data for a new, incompatible purpose without providing appropriate notice and establishing valid legal ground. Where processing relies on consent, the consent request will be clear and separate where appropriate, and the user may withdraw consent without affecting processing carried out before withdrawal.

REAL ESTATE AND PROPERTY-SPECIFIC PROCESSING

1. Property enquiries and matching: search criteria, budget, preferred communities, and engagement history may be used to identify relevant listings.
2. Viewings and access: names, contact information, attendance times and identity verification may be required for owner, developer, building-management, or community security requirements.
3. Leasing: relevant data may be exchanged among transaction parties, authorized brokers, developers, banks, trustees, registration bodies, and advisers to progress the transaction.
4. Property management: owner, tenant, occupant, lease, rent, maintenance, access, complaint, and contractor records may be used to administer managed properties.
5. Photographs and virtual tours: listing content should avoid unnecessary display of people, identity documents, or unrelated personal possessions. Removal or redaction requests will be assessed where EWIG controls the content.
6. Community and building operations: necessary data may be shared for move-in/out, access cards, permits, maintenance, inspections, safety, and community compliance.
7. Records: signed mandates, MOU, lease agreements, title/tenancy documents, invoices, and related communications are retained according to legal and business requirements.
8. Disclaimer of third-party information accuracy: EWIG may receive information from landlords, owners, developers, portals, brokers, tenants and third parties. EWIG does not guarantee and shall not assume liability for inaccuracies originating from third parties except where required by applicable law.

KYC AND SANCTIONS COMPLIANCE

For transactions subject to customer due diligence or other financial crime controls, EWIG may verify identity, authority to act, beneficial ownership, transaction purpose, and risk indicators. EWIG may request supporting documents, perform ongoing monitoring, retain compliance evidence, and make reports or disclosures to competent authorities where required or permitted by law.

Access to KYC records is restricted to authorized personnel and approved providers. EWIG will not disclose whether a suspicious activity report has been made where such disclosure is prohibited. Individuals who do not provide mandatory information may be unable to proceed with a transaction or business relationship.

WEBSITES, MOBILE APP, COOKIES AND SDKS

EWIG digital services may use cookies, local storage, pixels, tags and mobile SDKs for essential operation, authentication, security, preference storage, crash reporting, analytics, communications, maps, and other disclosed functions. Optional analytics or advertising technologies will be controlled according to applicable consent requirements.

EWIG will maintain a current register of cookies and SDKs identifying provider, purpose, data fields, identifiers, retention, hosting location, sub-processors, and transfer mechanism. Digital store privacy declarations must match actual App behavior.

DEVICE PERMISSIONS AND LOCATION

1. Camera or photo library: to scan or upload identity, property or transaction documents, profile content or property media selected by the user.
2. Location: to show nearby properties, support map/search functions or validate a user-selected location feature. Precise or background location will not be used without clear disclosure and appropriate permission.
3. Notifications: for accounts, viewing, transaction, security and service updates and separately controlled marketing.
4. Biometric login: where enabled, the device operating system may perform verification. EWIG should not receive the biometric template unless expressly disclosed.
5. Microphone, contacts, Bluetooth, or storage: requested only if a live feature requires it and explained before access.
6. Facial recognition: facial recognition may be used only for identity verification, secure login, access control, or another clearly described feature. Biometric templates or facial recognition data will not be collected, stored, shared, or processed unless necessary, lawful, clearly disclosed, and protected by appropriate security controls.

Permissions can normally be changed through device settings. Refusal may limit the related feature but should not prevent unrelated services.

COMMUNICATIONS AND MARKETING

EWIG may send service messages relating to enquiries, viewings, accounts, transactions, security, property management, and support. Marketing communications, including property opportunities, market updates and personalized recommendations, will be sent in accordance with applicable law and user preferences. Every eligible marketing message will provide an unsubscribe or preference-management method. Opting out of marketing does not stop essential service or legal communications.

CCTV, CALLS AND PHYSICAL SITE SECURITY

CCTV may operate at EWIG offices or managed premises for safety, access control, asset protection, incident investigation, and legal compliance. Signage should identify monitored areas. Cameras must not be placed in areas where there is a high expectation of privacy. Access is restricted, disclosures are controlled and footage is retained only for the approved period unless required for an incident or legal matter.

Calls may be recorded for quality, evidence, training, compliance, or dispute management where the caller is notified and a lawful ground applies. Call recordings will be access-controlled and retained according to the approved schedule.

SHARING AND RECIPIENTS

1. Lessee, tenants, guarantors, owners, occupants, and authorized representatives as necessary to progress a transaction.
2. Developers, master developers, property portals, other authorized brokers, and referral partners.
3. Property managers, building/community management, maintenance vendors, inspectors, valuers, and facilities providers.
4. Banks, payment processors, trustees, insurers, and financial institutions.
5. KYC, sanctions, identity verification, fraud-prevention, and compliance providers.
6. Government departments, land/property registration bodies, regulators, courts, and law-enforcement authorities where legally required or permitted.
7. Legal, audit, tax, and other professional advisers.
8. Companies providing authorized shared services under access, confidentiality, and data-governance controls.
9. Cloud hosting, CRM, communications, analytics, cyber security, document management, and support providers acting under contract.
10. A proposed lessee or successor in a corporate transaction, subject to confidentiality and lawful due diligence.

EWIG does not sell or rent personal data. Personal data is not disclosed to an independent third party for its own marketing unless a lawful basis and required consent are in place and the user is informed, except for disclosure to internal and external lawyers for the purpose of claiming and defending in disputes and litigation process.

PROCESSORS AND VENDOR GOVERNANCE

Service providers processing personal data for EWIG are selected through risk-based due diligence and bound by written terms covering documented instructions, confidentiality, security, personnel access, sub-processors, international transfers, incident notification, audit/evidence support, data-subject rights, retention, return, and deletion. EWIG remains accountable for selecting and overseeing processors within its responsibility. EWIG’s liability for selecting and overseeing processors is only limited to the extent required under applicable law. Each processor remains independently responsible and liable for its own acts, omissions, breaches of contract and violations of applicable data protection laws.

INTERNATIONAL TRANSFERS

EWIG aims to process and store data in approved locations. Where personal data is transferred outside the UAE, EWIG will identify the destination, recipient, and purpose; assess the availability of an applicable adequacy basis or other permitted transfer condition; implement contractual, organizational and technical safeguards; restrict onward transfers; and maintain records of the assessment and mechanism. Information about relevant safeguards may be requested through the privacy contact, subject to legal and confidentiality limitations and to the limits permitted by the applicable laws.

DATA RETENTION AND DELETION

EWIG retains identifiable personal data only for as long as necessary for the stated purpose and applicable legal, regulatory, tax, accounting, property, contractual, security, dispute, and limitation requirements. Retention is based on documented schedules rather than a single period for all data.

When retention ends, data is securely deleted, anonymized or isolated where continued retention is legally required. A legal hold overrides routine deletion only for the relevant records and duration. However, EWIG may retain personal data to comply with legal, regulatory, accounting, audit, or record-keeping obligations, to establish, exercise or defend legal claims, for regulatory investigations, litigation holds, dispute resolution proceedings, or where otherwise required or permitted by applicable law.

SECURITY MEASURES

EWIG uses risk-based technical and organizational controls designed to protect personal data against unauthorized or unlawful processing and accidental loss, destruction, alteration, or disclosure. Controls may include encryption in transit and at rest where appropriate, role-based access, multifactor authentication, least privilege, secure configuration and development, API security, secrets management, vulnerability assessment and penetration testing, logging and monitoring, endpoint and network protection, backup and recovery, supplier assurance, awareness training, incident response and access reviews. EWIG may disclose relevant records where reasonably necessary to detect, prevent or investigate fraud, misuse, cybersecurity incidents, unlawful activity, or breaches of EWIG’s contractual or legal rights, to the extent permitted, required, or otherwise preserved by applicable law.

No internet or mobile service is completely risk-free. Users should use strong credentials, protect one-time codes, enable device protection, keep software current and report suspected compromise promptly.

DATA SUBJECT RIGHTS

Subject to the UAE PDPL, verification, applicable conditions and exemptions, an individual may request information and access; correction or completion; deletion; restriction or cessation of processing; transfer of eligible data in a structured format; objection to certain processing; withdrawal of consent; and review of certain automated processing.

1. Submit a request to ewig@ccsupport.ae or through the designated App/website privacy channel.
2. Describe the request and the relevant account, property, transaction, or communication.
3. EWIG may request proportionate verification and evidence of authority for representatives.
4. EWIG will search relevant systems, assess exceptions, coordinate processors, and respond within the legally applicable period.
5. If a request is refused or limited, EWIG will explain the reason where legally permitted and provide complaint information.

AUTOMATED DECISION-MAKING AND PROFILING

EWIG may use limited profiling to match property preferences, prioritize enquiries, detect fraud, or personalize marketing. EWIG does not intend to make decisions producing legal or similarly significant effects solely by automated means unless the feature is specifically disclosed, a permitted legal condition applies and appropriate safeguards are provided, including human review where required. Individuals may object to profiling used for direct marketing.

CHILDREN’S PRIVACY

EWIG services and the App are not directed to individuals under 18. EWIG does not knowingly establish property transactions or digital accounts with children without an authorized parent, guardian or legal representative and an appropriate lawful basis. If personal data relating to a child is received, EWIG will apply enhanced minimization, access and verification measures and delete it when there is no lawful reason to retain it.

PERSONAL DATA BREACHES

EWIG maintains procedures to detect, report, assess, contain, investigate, and remediate personal data breaches. Incidents are documented and evaluated for notification to the competent authority and affected individuals where required. Processors must notify EWIG promptly under contract and preserve relevant evidence. Suspected compromise should be reported to ewig@ccsupport.ae and the designated support channel.

THIRD-PARTY PLATFORMS AND LINKS

EWIG websites, the App and property listings may link to or integrate with portals, maps, social media, payment gateways, identity services, or other third-party platforms. Where a third party independently determines its processing, its own privacy notice applies. EWIG will identify material integrations where practical, but users should review the third party’s notice before providing data.

CHANGES TO THIS POLICY

EWIG may update this Policy to reflect changes in law, services, technology, vendors, or processing. The current version and effective date will be displayed on the relevant website and App. Material changes will be communicated through an appropriate channel and renewed consent will be obtained where required.

CONTACT, REQUESTS AND COMPLAINTS

Individuals should first contact EWIG, so the request or concern can be investigated. They may also complain to the competent data protection authority where entitled to do so. Do not send passwords, one-time codes / passwords, or unnecessary identity documents by ordinary email.

This Policy shall be governed by and construed in accordance with the laws of the United Arab Emirates. Any dispute arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts of Abu Dhabi, unless otherwise required by applicable law.