Privacy Policy

This policy applies to the Nayirah Real Estate website and the forms and contact channels attached to it, and to the personal data we process as a data controller. Personal data means anything that identifies a natural person or makes them identifiable — such as a name, a mobile number or an email address.

Using the website or submitting any of its forms means you have read this policy. If you do not agree with it, please do not provide us with your personal data.

Data you give us — when you fill in a project interest form, a service request form, the contact form, or when you subscribe to the newsletter:

• Your name.
• Your email address and mobile number.
• The project or service you are interested in.
• Any notes or questions you write yourself in the message field.

Data collected automatically the moment you visit, recorded in the server logs for technical and security purposes:

• Your IP address.
• Your browser, device and operating system.
• The pages you visited, and when and how long you visited.
• The link that referred you to the site, if any.

And your correspondence with us — what you send by email, WhatsApp or phone, together with the notes our team records to follow up on your request.

We do not ask you for sensitive data — health, religious or biometric — and we never request banking details or card numbers through the website. If such a request reaches you in our name, do not respond to it and let us know.

We process your data for the following purposes only, and will not use it for anything else without telling you:

• Answering your enquiries and following up on your property requests.
• Recommending the projects, units and services that match the needs you described.
• Completing sale, lease or brokerage procedures and the documentation tied to them.
• Running and maintaining the website, measuring its performance and improving the experience.
• Sending updates and marketing offers if you subscribed to the newsletter or authorised us to.
• Meeting our statutory and regulatory obligations before the competent authorities in the Kingdom.
• Protecting the site and its users from fraud and misuse, and establishing rights in a dispute.

Each of these purposes rests on a lawful basis: your explicit consent, the performance of a contract you are party to and pre-contractual steps taken at your request, a legal obligation on us, or a legitimate interest that does not override your fundamental rights — all under the Personal Data Protection Law and its Implementing Regulations.

We use the smallest set of cookies we can, and all of them are necessary to run the site rather than to track you across other websites:

• A cookie that remembers your language preference (Arabic or English) so you are not asked on every visit.
• A session cookie for the admin dashboard, created only for company staff when they sign in.

We place no third-party advertising cookies and no campaign tracking pixels on the site. You can delete or block cookies in your browser settings, though blocking the necessary ones may break some of the site’s functionality.

We do not sell, rent or trade your personal data. We share it only as far as necessary, and only with the following:

• Technical service providers running our hosting, email and data storage on our behalf, bound by contract to protect it and not to use it beyond what they were engaged for.
• Project owners and real estate developers, where your request concerns a specific project and fulfilling it requires passing your details on to them.
• Professional advisers — lawyers, accountants and auditors — when needed and only as far as needed.
• Competent government and judicial authorities, where the law or a court order requires it.

Some project pages show a map whose tiles load from an external open-map provider, which therefore receives your IP address as a consequence of your browser requesting those tiles. We send it neither your name nor your contact details.

The site also links to our social media accounts and to WhatsApp. The moment you leave our website, your visit is governed by that platform’s privacy policy rather than ours, so we recommend reading it.

We keep your data for as long as the purpose it was collected for requires, then destroy it or strip it of anything that identifies you.

Data from interest, contact and newsletter forms is kept for no more than 24 months after your last interaction with us, unless you ask us to delete it sooner or the law requires longer — as with documents tied to a concluded transaction, which are kept for the period accounting and real estate regulations impose.

We take organisational and technical measures to protect your data from unauthorised access, disclosure or destruction: encrypted connections to the site, access limited to the team members whose work requires it, an authenticated session guarding the admin dashboard, and periodic permission reviews.

Even so, no transmission of data over the internet is free of risk, so absolute security cannot be guaranteed. Should a breach seriously affect your data, we will notify you and the competent authority as the law requires.

The Personal Data Protection Law of the Kingdom grants you the rights below, and exercising them is free of charge:

• The right to be informed: to know the legal basis for collecting your data and the purpose behind it.
• The right of access: to see the data we hold about you.
• The right to obtain a copy: to receive it in a clear, readable format.
• The right to rectification: to have incomplete, inaccurate or outdated data corrected.
• The right to erasure: to have your data deleted once it is no longer needed for the purpose it was collected for.
• The right to withdraw consent: to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to us at [email protected] and we will respond within 30 days of receiving your request. We may ask you to verify your identity first, so that no one else can reach your data.

If our response does not satisfy you, you may lodge a complaint with the authority that supervises the application of the Personal Data Protection Law in the Kingdom.

We send you marketing messages only if you subscribed to the newsletter or expressly authorised us to. You can stop them whenever you like through the unsubscribe link at the bottom of the message, or by writing to us directly — and doing so will not affect our follow-up on your existing property requests.

The website and its services are meant for those aged 18 and over, and we do not knowingly collect data from minors. If we learn that data reached us from a minor without their guardian’s permission, we destroy it. A guardian who believes their child gave us data is welcome to write to us.

Some of our technical service providers may sit outside the Kingdom, in which case your data is processed by them only as far as the service requires. This happens solely under the controls on transfer and disclosure outside the Kingdom set out in the Personal Data Protection Law, and after confirming that the recipient’s level of protection is no lower than the law demands.

We may update this policy whenever our services or the regulatory requirements change, and the updated version is published on this page, replacing the one before it from the date it goes up. If a change is material and affects your rights, we will tell you through the website or by email before it takes effect.

For any question about this policy, to exercise one of your rights, or to raise a complaint about how your data is handled — reach us through the channels below and our responsible team will take up your request.