Privacy notice

1. Data controller

Performoon OÜ (registry code: 17001386, registered address: Ahtri tn 12, 15551 Tallinn, Estonia) operates this website and acts as data controller. Contact: info@dubaingatlan.hu or office@performoon.com.

2. Data we process

Through the contact form you provide your name, email address, phone number, investment budget, preferred location and message. We also record the fact and time of your acknowledgement and the page path. The web server and security systems may process technical data from the HTTP request, such as the IP address, browser and device information and a timestamp. Traffic and campaign parameters are stored in the browser session only after the relevant cookie choice has been made. If you then submit the form, the current campaign parameters become part of the enquiry and are retained for the same period as the enquiry.

3. Purposes and legal bases

• (a) Responding to your enquiry and preparing a personalised shortlist — pre-contractual steps at your request, GDPR Article 6(1)(b).
• (b) Sharing data with a contracted real estate sales partner — only where needed for the requested shortlist, after the recipient and transfer terms have been disclosed and an appropriate legal basis and transfer mechanism are in place.
• (c) Newsletters and marketing communications — your consent, GDPR Article 6(1)(a).
• (d) Analytics and advertising — your consent given in the cookie banner, GDPR Article 6(1)(a).
• (e) Protecting the website and form against abuse and automated spam — our legitimate interests, GDPR Article 6(1)(f).

4. Recipients (third-party transfers)

An enquiry submitted through the form is not automatically shared with a property sales partner. If preparing the requested shortlist requires us to involve a Dubai- or UAE-based developer, brokerage or local property professional, before any transfer we will tell you the recipient's identity or precise category, the purpose of the transfer, the data involved and the applicable transfer terms. We share data only after the required prior steps have been completed.

5. International transfers

Many of our contracted partners operate outside the European Union, in the United Arab Emirates (UAE). The European Commission has not adopted an adequacy decision for the UAE, so EU data protection law (GDPR) does not apply directly to those partners and EU-level safeguards do not apply automatically.

Before a transfer to the UAE, we assess and, where applicable, use an appropriate safeguard under GDPR Article 46, such as Standard Contractual Clauses. If no such safeguard is available, an occasional transfer may take place only after you have been informed of the specific recipient and risks and have given explicit consent under GDPR Article 49(1)(a). Submitting the website form does not by itself provide that transfer consent.

Resend, which delivers transactional emails, Google LLC (Gmail), which receives lead notifications, and Cal.com, which provides appointment booking, are US-based or globally operating services. Processing outside the European Economic Area is subject to the applicable transfer safeguards, such as the EU–US Data Privacy Framework where available or Standard Contractual Clauses.

6. Contact via WhatsApp and booking

When you contact us on WhatsApp or book an online consultation, we process the data you provide (name, phone number, email address, message content, booking details) to answer your enquiry and prepare an offer, based on GDPR Article 6(1)(b).

A website form, WhatsApp message or booking does not by itself authorise us to share your data with a UAE property sales partner. If such a transfer is needed for the requested shortlist, we first identify the recipient or precise recipient category and explain the transfer terms and risks, then complete the required legal step.

The retention periods, categories of recipients and data subject rights set out elsewhere in this notice apply equally to such enquiries.

7. Retention

We retain enquiries, including copies held in the notification mailbox, for 24 months from the last substantive contact. They are then deleted from active systems; copies in provider backups may be deleted according to the provider's retention cycle. Data evidencing consent (timestamp, text version and page path) is kept for a reasonable period thereafter to demonstrate compliance. The form's in-memory, IP-based rate-limit entry expires after 60 seconds; security logs kept by the hosting and network provider follow that provider's retention schedule.

8. Recipients and service providers

We use the following recipients and technical service providers; some may also act as independent controllers in relation to parts of their services:

• Hosting provider for operating the website and transmitting incoming enquiries.
• Resend (Plus Five Five, Inc., United States) — transactional email delivery for internal lead notifications and confirmations sent to the person submitting an enquiry.
• Google LLC (Gmail) — mailbox provider for the authorised DubaIngatlan recipient; the internal notification contains the information submitted through the form.
• Google — analytics and advertising (Google Analytics, Google Ads), based on consent.
• Cal.com, Inc. (United States) — scheduling online consultations and processing the information needed for a booking.
• Meta / WhatsApp — messaging. WhatsApp communication is subject to Meta's own data practices, which may include processing outside the European Union.

9. Your rights

You have rights of access, rectification, erasure, restriction of processing and data portability, and you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it. You may also object to processing based on legitimate interests.

You may withdraw consent at any time by emailing info@dubaingatlan.hu or office@performoon.com.

You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

10. Deletion requests

Send deletion requests to info@dubaingatlan.hu or office@performoon.com. We fulfil legitimate deletion requests within 30 days of receipt.