Policy
Privacy policy
How Dubaiesque Marketing Management collects, uses, shares and protects personal data, under UK GDPR and UAE Federal Decree-Law 45 of 2021. Last updated 22 October 2026.
1. Who is the data controller?
The controller is Dubaiesque Marketing Management, a sole establishment licensed by the Dubai Department of Economy and Tourism (Trader Licence No. 1659843, activity: marketing management), owned and operated by Dr Deepak Songra. Contact: info@dubaiesque.com; WhatsApp +971 55 293 1121; UK correspondence address 151 Cassiobury Drive, Watford, Hertfordshire, WD17 3AH, United Kingdom; Dubai: Office 1601, O-14 Tower, Marasi Drive, Business Bay, Dubai, UAE. Dubaiesque is the trading name of that establishment; it is not a limited company and not a licensed brokerage. Where a property or clinic transaction proceeds, Provident Real Estate Broker L.L.C (ORN 1933) becomes a separate controller of the transaction data under its own privacy notice.
2. Which laws apply?
This website serves visitors in the United Kingdom, the United Arab Emirates and elsewhere. We apply the UK General Data Protection Regulation and the Data Protection Act 2018 to UK visitors and to processing at the UK address, and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) to processing in the UAE. Where the two differ, we apply the stricter standard. Visitors elsewhere have at least the rights set out in section 9.
3. What data do we collect, and from where?
- Enquiry and contact forms: name, email, WhatsApp number, profession, what you want, the page you were on, and your consent.
- Lead-magnet forms: name, email, profession, and your consent to receive the download and related emails.
- Booking: the details you give the Google Calendar appointment page (name, email, notes), the time of the call, and the Google Meet record.
- WhatsApp: your number, name as shown, and the content of messages you send.
- Client preference form (after a call): budget range, areas, timeline, licence status, family and pet details, and anything else you choose to tell us.
- Email list: your email and name, held in MailerLite, with opens and clicks.
- Cookies and analytics: with your consent only, Google Analytics 4 usage data (pages, device, approximate location derived from a truncated IP address). Essential cookies are described in the cookie policy.
- Shop purchases: name, email, the product, and the payment reference from the payment processor; we do not see or store card numbers.
- Referral scheme: your details and your colleague's, with consent.
- Transaction data: passport, Emirates ID, proof of funds and similar, collected by Provident Real Estate for a transaction under its own notice and UAE anti-money-laundering rules.
We do not collect special category data unless you volunteer it (for example a health condition relevant to a move), and then only with your explicit consent.
4. Why do we process it, and on what lawful basis?
| Purpose | Lawful basis (UK GDPR) | Basis (UAE PDPL) |
|---|---|---|
| Replying to your enquiry and holding the call | Legitimate interests (responding to a request), and consent given on the form | Consent; contractual necessity |
| Sending a lead magnet and related emails | Consent | Consent |
| Marketing emails and the monthly letter | Consent, withdrawable at any time | Consent |
| Brokering a transaction | Performance of a contract; legal obligation (RERA, AML) | Contractual necessity; legal obligation |
| Analytics | Consent | Consent |
| Digital product sales | Performance of a contract; legal obligation (tax records) | Contractual necessity; legal obligation |
| Referral scheme | Consent; performance of the scheme terms | Consent |
| Security and fraud prevention | Legitimate interests | Legitimate interests as permitted |
5. Who do we share it with (processors and recipients)?
- Google (Workspace email, Calendar, Meet, Analytics with consent): processing in the UK, EU and US under Google's data processing terms and standard contractual clauses.
- MailerLite (email list and automations): EU-based processor.
- Meta (WhatsApp Business messaging; Instagram and Facebook pages; advertising pixels only with cookie consent): processing under Meta's terms, with transfers to the US under its approved mechanisms.
- Zapier (routing form submissions to a lead sheet and sending notifications): US-based processor under standard contractual clauses.
- Provident Real Estate Broker L.L.C (independent controller for any transaction): Dubai, UAE.
- Payment processor and download platform for shop purchases.
- Professional advisers (accountants, lawyers) and regulators (RERA, DLD, the ICO, the UAE Data Office) where required by law.
We do not sell personal data and we do not share it with third parties for their own marketing.
6. International transfers
Data moves between the United Kingdom and the United Arab Emirates because the controller operates from both, and to the EU and US through the processors above. For transfers out of the UK we rely on UK adequacy regulations where they exist (the EU), the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses otherwise, and a transfer risk assessment. For transfers out of the UAE we rely on the PDPL's provisions for transfers to jurisdictions with adequate protection or, otherwise, on contractual safeguards and your explicit consent where required.
7. How long do we keep it?
| Data | Retention |
|---|---|
| Enquiries, calls and WhatsApp conversations that do not become a transaction | 24 months from last contact, then deleted |
| Client and transaction records | 7 years from completion, for tax, RERA and anti-money-laundering requirements |
| Marketing list | Until you unsubscribe or 24 months of inactivity, whichever is first |
| Analytics data | 14 months (Google Analytics setting) |
| Shop purchase records | 7 years, for tax |
| Referral scheme records | 7 years from the qualifying event, or 24 months if no qualifying event |
8. How do we protect it?
Encrypted services with two-factor authentication, access limited to Dr Deepak Songra and named processors, no personal data in AI tools, and no credentials stored in shared folders. No system is perfectly secure; if a breach is likely to result in a risk to you, we will notify the ICO within 72 hours and the UAE Data Office as the PDPL requires, and tell you without undue delay.
9. What are your rights?
Under UK GDPR and the UAE PDPL you can ask us to: access your data; correct it; erase it; restrict or object to processing; receive it in a portable format; withdraw consent at any time (which does not affect processing before withdrawal); and not be subject to automated decision-making with legal effect, which we do not use. Email info@dubaiesque.com. We respond within one month (UK) and within the period the PDPL requires. There is no fee unless a request is manifestly unfounded or excessive.
10. How do you complain?
To us first, at info@dubaiesque.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113) and to the UAE Data Office under the PDPL. We would appreciate the chance to resolve the matter first.
11. Children
This site and its services are for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email info@dubaiesque.com and we will delete it.
12. Cookies
See the cookie policy. Analytics and advertising cookies run only after you accept them in the banner, and you can withdraw consent at any time from that page.
13. Changes
We will post changes here with a new date. Material changes will be announced to the email list. This version: 22 October 2026, replacing the policy dated 7 April 2025.