Privacy Policy

Effective date [7 September 2026]

1. Introduction

Arada (“we“, “us“, or “our“), part of Arada Group, is committed to protecting your personal data in accordance with Law No. 12 of 2024 on the Protection of Electronic Personal Data (the “Data Protection Law“), Law No. 20 of 2022 on Cybercrime, and other applicable laws of the Syrian Arab Republic, together with any implementing instructions issued by the competent Syrian authority.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our real estate development, sales, leasing, property management, after-sales, community management, and related digital services (the “Services“), including when you enquire about, reserve, purchase, lease, or manage a property; communicate with our sales, customer care, or facilities management teams; use our website, mobile application, sales offices, communities, or other channels; or otherwise interact with us.

This Privacy Policy applies to personal data we collect from customers and prospective customers, purchasers, owners, tenants, occupants, brokers, authorised representatives, visitors to our website, mobile application, sales offices, communities, and premises, and emergency contacts provided by them.

Some of the information we process is treated as sensitive personal data under the Data Protection Law, including biometric data where used for community or facility access. We process personal data on the basis of your explicit and informed consent, except where processing is required or expressly permitted by Syrian law. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Please read Section 7 (Disclosure to Syrian Authorities and Mandatory Retention) carefully. Syrian law requires us to retain certain data and to disclose personal data to competent authorities on lawful request. This is a legal obligation we cannot contract out of, and it applies regardless of your consent.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Personal Data We Collect

We collect personal data that is necessary to provide and improve the Services. Depending on how you interact with us, this may include:

2.1 Identity and Contact Information

• Full name, date of birth and/or age, and nationality
• Syrian national identity number, civil registry extract, passport number, or residency document (where required for verification, registration, or check-in)
• E-mail address and phone number
• Residential or billing address
• Emergency contact details (where you choose to provide them)

2.2 Real Estate Information

• Property enquiries, preferences, budgets, unit interests, reservation details, sale and purchase contract information, lease details, handover records, title and cadastral documentation, powers of attorney, and customer relationship records
• Broker, authorised representative, owner, tenant, occupant, and emergency contact information where relevant to the property transaction or ongoing property management

2.3 Facility Access and CCTV Information

• Biometric access-control data, where used to grant access to communities, buildings, amenities, or other facilities, processed only with your separate explicit consent, stored in encrypted form, and not used for any other purpose. Where you prefer not to provide biometric data, we will offer an alternative means of access.
• CCTV footage captured by security cameras in sales offices, public areas, common areas, community facilities, building entrances, and other premises

2.4 Account, Billing and Payment Information

• Account credentials (stored in encrypted/hashed form where applicable)
• Property ownership, tenancy, occupant, or customer profile details
• Payment information (processed via authorised banks and payment providers; we do not store full card numbers)
• Billing history, instalment records, invoices, receipts, service charge records, and related payment correspondence
• Marketing preferences and consent records

2.5 Usage, Technical and Location Data

• App and website interactions (for example, screens viewed, clicks, session duration)
• Device type, operating system, app version, IP address, browser type, and device identifiers
• Log data, diagnostic data, and crash reports
• Location data : approximate or precise location if you enable device permissions
• Cookies and similar tracking technologies (see Section 12 (Cookies and Tracking Technologies))

2.6 Customer Support and Communications

• Customer care requests, maintenance requests, complaints, feedback, survey responses, and related correspondence
• Records of communications with our sales, leasing, handover, facilities management, community management, finance, legal, compliance, or customer care teams

3. How We Collect Your Data

We collect your data directly from you when you:

• register an account or complete a purchase, reservation, ownership, tenancy, handover, or service application
• enquire about, reserve, purchase, lease, or manage a property
• register for or use our mobile application, website, owner portal, tenant portal, or community platform
• visit or check in at our sales offices, communities, buildings, amenities, offices, or other premises
• contact us by email, telephone, online form, chat, or in person
• submit customer care requests, facilities management requests, complaints, feedback forms, surveys, or competition entries

We also collect data automatically when you use our website or app (for example, through cookies), and, where applicable, from access-control systems and CCTV cameras at our premises. Where we obtain your data from a third party (for example, a broker, a co-purchaser, or an authorised representative acting for you), we will inform you and, where required, obtain your consent before processing it.

4. Legal Basis for Processing

Under the Data Protection Law, consent is the primary basis for processing personal data. We therefore process your personal data on the following bases:

• Your explicit and informed consent: obtained separately for each processing purpose, including the creation and management of your account, property enquiries, reservations, sales, leases, handovers, payments, service requests, community access, service communications, biometric access control, marketing, non-essential cookies, and cross-border transfers. Consent is recorded and evidenced, is not bundled with our contractual terms, and may be withdrawn at any time.
• Compliance with a legal obligation: where Syrian law requires us to collect, retain, or disclose personal data, including real estate registration and cadastral requirements, anti-money laundering and counter-terrorist financing obligations, tax and accounting requirements, data-retention duties, and lawful requests from competent authorities. In these cases we process your data whether or not you consent, and we cannot delete it on request.
• Performance of a contract with you: where processing is strictly necessary to perform a contract you have entered into with us, or to take steps at your request before entering into such a contract.
• Protection of vital interests: in limited circumstances, to protect your life or physical safety or that of another person, such as in a medical or safety emergency.

We do not rely on “legitimate interests” as a basis for processing. Where an activity is not strictly necessary for a contract or required by law, we will ask for your consent, and you are free to refuse. Refusing consent to optional processing will not affect your ability to purchase, lease, or occupy a property, except where the data is genuinely required to complete the transaction or to comply with the law.

If you withdraw consent, we will stop the relevant processing unless we are separately required by Syrian law to continue holding or processing the data. We will tell you which of your data we must retain and why.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• Registering and managing your account, property enquiry, reservation, purchase, lease, ownership, tenancy, or occupant profile
• Providing the Services, including property transactions, handover, after-sales support, facilities management, community management, and customer care
• Verifying your identity where required by law, for transaction due diligence, or for safety and security purposes
• Carrying out know-your-customer and anti-money laundering checks, source-of-funds verification, property and cadastral registration, title documentation, service charge records, and regulatory filings
• Carrying out international sanctions and restricted-party screening, which our group and our banking partners are required to perform
• Providing customer support and handling requests, complaints, maintenance requests, or community-related matters
• Processing payments and managing billing, instalments, receipts, invoices, refunds, and service charges
• Sending service, transaction, community, safety, and legal notices
• Sending marketing communications, where you have consented
• Detecting and preventing fraud, misuse, unauthorised access, and security incidents
• Analysing usage to maintain, improve, and develop the Services, using aggregated or anonymised data wherever possible
• Analyzing customer, property, and community data to understand demand, plan future projects, measure performance, and improve the products and services offered across Arada Group, as described in section 6.2 (Group Analytics)
• Complying with applicable Syrian legal and regulatory obligations

We do not use your personal data to make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. If we introduce such processing, we will notify you in advance and obtain your consent.

6. Sharing of Personal Data

We do not sell your personal data. We may share it only in the circumstances described below.

6.1 Within the Arada Group

The Arada Group is made up of separate legal entities operating across real estate, hospitality, food and beverage, fitness and wellness.  We update this list whenever a new business joins the Group.

Most Arada Group entities are established outside the Syrian Arab Republic. Sharing your personal data with them is therefore a cross-border transfer, and Section 8 (Cross-Border Transfers) applies.

Access to your personal data within the Arada Group is limited to authorised recipients on a strict need-to-know basis and only to the extent necessary for the relevant processing purposes, including real estate sales, leasing, handover, customer care, community management, facilities management, finance, legal, compliance, IT, marketing, and corporate administration.

Where you have given separate, specific consent, we may share your contact details and marketing preferences with the Arada Group companies you have selected, so that they can send you marketing about their products, services, projects, communities, property services, events, and related offers. You give consent for each brand and each contact method (e-mail, SMS, telephone, and messaging applications) separately. Your consent to cross-Group marketing is entirely voluntary and is not a condition of any product or service we provide. The unsubscribe link in a marketing message stops marketing from the brand that sent it.

Health and clinical information is not shared for marketing purposes and is handled under a separate privacy policy available at https://everwell.ae/privacy-policy/ . Where an Arada Group business is established or acquired after you gave your consent, we will update the list and ask you again before that business markets to you.

6.2 Group Analytics

We analyze information about how our customers interact with us in order to understand demand, plan projects and communities, measure performance, and improve the products and services offered across the Arada Group.

Wherever possible we carry out this analysis using anonymized data from which you cannot be identified. Once data has been anonymized so that it can no longer be linked to you, it is no longer personal data, and this Privacy Policy does not restrict our use of it.

Where Group Analytics requires data that can still identify you, for example, linking your inquiry history with your purchase, tenancy, or community records to build customer insight, we will do so with your separate explicit consent.

6.3 Service Providers

We share data with trusted third-party service providers that help us operate the Services, such as hosting providers, customer support platforms, analytics providers, and payment providers. These parties act only on our documented instructions, are bound by written data processing agreements imposing confidentiality and security obligations, and may not use your data for their own purposes.

6.4 Real Estate Transaction Parties

Where relevant to a property transaction, we may share information with banks and financing providers, notaries, conveyancers and legal representatives, the General Directorate of Cadastral Affairs and other land registration and municipal authorities, developers, brokers, and owners’ association or facilities management providers.

6.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the relevant successor entity, subject to appropriate privacy protections and to the transfer conditions in Section 8.

6.6 Professional Advisers

We may share information with lawyers, auditors, and other professional advisers, who are bound by confidentiality obligations.

6.7 Safety and Emergency

We may share personal data with emergency services or other relevant parties where necessary to protect your life or physical safety or that of another person.

7. Disclosure to Syrian Authorities and Mandatory Retention

We are required to disclose personal data to Syrian governmental, judicial, regulatory, and security authorities where they make a request that is lawful under the Data Protection Law, Law No. 20 of 2022 on Cybercrime, or other applicable Syrian legislation. Syrian law also requires certain categories of records and communications data to be retained for defined periods and made available to those authorities on request.

We take the following approach to such requests:

• We require the request to be made in writing by a competent authority and to identify its legal basis.
• We disclose only the data that falls within the scope of the request, and no more.
• We keep an internal record of the request and of what was disclosed.
• Where we are legally permitted to notify you that your data has been requested, we will do so.

We are not always permitted to notify you, and in some cases we may be prohibited by law from doing so. Your consent is not required for these disclosures and withdrawing consent will not prevent them.

8. Cross-Border Transfers

Your personal data may be transferred to, stored, or processed outside the Syrian Arab Republic, including in the United Arab Emirates, where Arada Group’s central systems and support functions are located, and in other countries where our service providers operate.

Under the Data Protection Law, we may transfer your personal data outside Syria only where:

• the recipient country provides an adequate level of protection for personal data, as recognised by the competent Syrian authority; or
• appropriate contractual or organisational safeguards are in place, in a form approved or accepted by the competent Syrian authority; or
• you have given your explicit consent to the transfer after being informed of the associated risks; or
• the transfer is otherwise permitted or required under Syrian law.

Where we rely on your explicit consent, we will tell you which countries are involved and explain that those countries may not provide the same level of protection as Syrian law, and that Syrian authorities may have limited ability to enforce your rights against a recipient abroad. You may refuse or withdraw this consent. If you do, we may not be able to provide certain digital features that depend on our regional systems, and we will tell you which ones.

A written data processing agreement is in place with every processor engaged to process personal data on our behalf, in Syria or abroad, and we carry out a documented assessment of the recipient and destination before transferring.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. In particular:

• Account data is retained for as long as your account, ownership, tenancy, occupant, or customer profile remains active. If you request deletion, we will delete or anonymise your data unless we must retain it for legal, regulatory, contractual, accounting, or security reasons.
• Property transaction, title, cadastral, reservation, sale contract, tenancy, handover, know-your-customer, anti-money laundering, and regulatory records are retained for the period required under applicable real estate, anti-money laundering, tax, accounting, regulatory, and limitation requirements.
• Records and communications data subject to a statutory retention obligation are retained for the period prescribed by Syrian law, even where you have asked us to delete them.
• Biometric data is deleted promptly upon termination of access rights or withdrawal of consent, unless a longer retention period is required by law.
• Marketing preferences are retained until you withdraw consent, unsubscribe, or delete your account, subject to any suppression-list retention required to respect your opt-out.
• CCTV footage is retained for a limited period, unless required for security investigations, insurance claims, dispute resolution, or legal obligations.

Retention periods are reviewed periodically to ensure compliance with applicable law and the data minimisation principle.

10. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

• Encryption of sensitive data in transit and, where appropriate, at rest
• Access controls and authentication measures, limiting staff access on a need-to-know basis
• Additional safeguards for biometric data, including role-based access controls, secure storage of biometric templates, and monitoring and audit logs, where biometric access-control systems are used
• Heightened confidentiality controls for ownership, title, and occupancy records, given their sensitivity
• Regular staff training on data protection and confidentiality obligations
• Documented incident response and breach notification procedures

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the competent Syrian authority and, where the breach is likely to cause you harm, we will notify you without undue delay, in accordance with the Data Protection Law and any implementing instructions in force at the time.

11. Your Rights

Under the Data Protection Law, you have the following rights in relation to your personal data, subject to applicable conditions and exceptions:

• Right to be informed: to be told what personal data we process, for what purposes, and on what basis, before or at the time of collection.
• Right of access: to request a copy of the personal data we hold about you.
• Right to correction: to request correction or updating of inaccurate or incomplete data.
• Right to erasure: to request deletion of your personal data, subject to legal and regulatory retention requirements.
• Right to object and to restrict processing: to object to processing, including for direct marketing, and to ask us to limit processing in certain circumstances.
• Right to withdraw consent: to withdraw your consent at any time where we rely on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right to complain: to lodge a complaint with the competent Syrian data protection authority if you believe your rights have been infringed. These rights do not apply to data we are required by Syrian law to collect, retain, or disclose, and they cannot be exercised to prevent a lawful disclosure to a competent authority.

To exercise your rights, please contact us using the details in Section 16 (Contact Us). We will verify your identity before responding, and we will respond within the period required by applicable law. There is no charge for exercising your rights, unless a request is manifestly excessive or repetitive.

12. Cookies and Tracking Technologies

Our website and app use cookies and similar technologies (such as SDKs and pixels) to help provide, protect, and improve the Services. These include:

• Essential cookies and technologies: required to operate the Services, for example authentication and session management. These are placed without consent because the Services cannot function without them.
• Analytics cookies and technologies: help us understand how users interact with the Services so we can improve performance and user experience. These are placed only with your consent.
• Marketing cookies and technologies: used to deliver and measure relevant promotional content. These are placed only with your consent.

You can accept or refuse non-essential cookies through our cookie preferences panel when you first visit, and change your choice at any time through that panel or your browser settings. Refusing non-essential cookies will not prevent you from using the Services, although some features may be less personalised.

13. Children’s Privacy

The Services are not directed at persons under the age of 18. We may process personal data relating to minors where a parent, guardian, owner, or tenant provides information about children as occupants, residents, dependants, emergency contacts, or users of community facilities. Where personal data of a minor is processed, we do so only with the consent of a parent or legal guardian, or where required or permitted by applicable law, and we limit the data to what is necessary. If we become aware that personal data of a child has been collected without appropriate consent, we will delete it promptly.

14. Language

This Privacy Policy is issued in Arabic and English. In the event of any inconsistency between the two versions, the Arabic version prevails.

15. Updates to This Policy

We may update this Privacy Policy from time to time, including to reflect changes in Syrian law or in implementing instructions issued by the competent authority. The updated version will be indicated by an updated “Last updated” date and will be effective when posted. Where a change materially affects how we use your personal data, we will notify you and, where required, obtain fresh consent. We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have any questions or concerns, or wish to exercise your rights under this Privacy Policy, please contact legal@arada.com