Privacy Policy

1.1 One controller operates the Platform. Oliva DB Properties CO. L.L.C. S.O.C. ("Oliva"), a mainland Dubai limited liability company licensed by the Real Estate Regulatory Agency under Brokerage Registration Number 1573501, with its registered office at Ontario Tower, C1801, Business Bay, Dubai, United Arab Emirates, is the sole data controller for all personal data processed in connection with the Platform (browsing, scoring, AI-generated content, analytics) and for personal data processed in connection with brokerage representation on a specific transaction (KYC, source-of-funds documentation, RERA Form B, Sale and Purchase Agreement, escrow correspondence, and Oqood and DLD registration).

1.2 Contact details.

• Oliva: Oliva DB Properties CO. L.L.C. S.O.C., RERA Brokerage Registration Number and Trade Licence Number 1573501, Ontario Tower, C1801, Business Bay, Dubai, United Arab Emirates. TRN 105237083800001. Data-protection contact: hello@joinoliva.com. Phone: +971 50 852 1658.

1.3 Scope. This Privacy Policy applies whenever you access joinoliva.com or any associated services (collectively, the "Platform"), use our scoring tools or calculators, generate AI content, purchase the Oliva Underwriting Report, or communicate with us through any channel. Browsing the Platform is free and no account registration is offered or required: you browse anonymously. Oliva sells one paid product through the Platform, the Oliva Underwriting Report, at AED 1,500 including 5% UAE VAT, bought through anonymous guest checkout. Payment data handling is described in Part 4 and retention of the resulting transaction records in Part 7.

1.4 Compliance is with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), and, for visitors resident in the European Economic Area, the United Kingdom, or Switzerland, the EU GDPR or UK GDPR (described in Part 14).

Contact data (only if you contact us): Email address, mobile phone, WhatsApp number, name, and country of residence, when you voluntarily submit them through a contact form, lead form, newsletter signup, or a WhatsApp or email conversation with us.

Technical data: IP address, browser type and version, device type and operating system, approximate location derived from IP, pages visited, time spent on pages, referral source, and cookie identifiers.

Communication data: Email correspondence, WhatsApp messages, phone-call records, survey responses, feedback, and complaint records.

Scoring and engagement data: Oliva Score interactions, project comparison activity, financing-calculator inputs, and Data Center usage patterns. This usage data is not linked to any account; the Platform has none.

AI content data: Prompts and inputs you provide, the retrieved context (data points pulled from official Dubai Land Department datasets and licensed third-party data) used to ground each AI output, the model identifier, and the full output served to you. Audit-log records of each AI generation are described in Part 9A.

Brokerage engagement data (only if you engage Oliva as your broker): If you separately choose to engage Oliva for brokerage representation on a specific transaction, we collect the identity, financial, and transaction documentation UAE law requires of a licensed broker: full legal name, nationality, passport details, Emirates ID (UAE residents), KYC and source-of-funds documentation, RERA forms, Sale and Purchase Agreements, and Oqood and DLD registration details. None of this is collected through ordinary use of the website.

How we collect data. Directly from you when you contact us or engage us on a transaction. Automatically through cookies (subject to your consent), server logs, and platform analytics. For brokerage engagements, from third parties including property developers (transaction data), DLD and RERA (registration records), and publicly available sources (sanctions lists, PEP databases).

Service delivery (contractual necessity, PDPL Article 4 / GDPR Article 6(1)(b)): Responding to your inquiries, generating AI outputs you request, and, where you engage Oliva as your broker, facilitating the transaction from due diligence through to Oqood and DLD registration.

Legal and regulatory compliance (legal obligation, brokerage engagements only): Conducting Customer Due Diligence and Enhanced Due Diligence, verifying source of funds, maintaining transaction records as required by RERA and DLD, filing Suspicious Activity Reports with the Financial Intelligence Unit via goAML, VAT compliance, and UAE corporate-tax compliance.

Platform improvement (legitimate interest): Analyzing usage patterns to improve scoring, AI outputs, and user experience; developing new features; quality assurance and performance monitoring.

Communication (contractual necessity): Replies to your inquiries and customer support. Oliva does not conduct email marketing.

Security and fraud prevention (legitimate interest): Detecting financial crime, monitoring for suspicious activity, and maintaining platform security.

Service providers (data processors):

• Anthropic (United States): AI content generation. Anthropic is a sub-processor under a written Data Processing Addendum that prohibits use of customer data for model training.
• Resend: Transactional email delivery (replies and notifications you request).
• Cloudflare: Content delivery, security, R2 object storage.
• Hostinger (India): Platform hosting and server infrastructure.
• Sanity CMS: Content management for educational and editorial content.
• Google Analytics, Google Tag Manager: Platform usage analytics (with your consent).
• Microsoft Clarity (United States): Session analytics and heatmaps (with your consent).
• Mapbox, Google Places: Mapping and location services for project discovery.
• Meta: Advertising measurement and conversion tracking (with your consent).
• LinkedIn: Advertising measurement and professional audience targeting (with your consent).
• Cal.com: Appointment scheduling.
• iDenfy (Lithuania, EU): KYC and AML identity verification for brokerage engagements only: document authentication, sanctions and PEP screening.

Payment processing: Stripe. When you purchase the Oliva Underwriting Report, checkout is processed by Stripe Payments Europe, Ltd. Stripe collects your email address and payment details directly and acts as an independent controller for them; Oliva receives your email address, the amount paid and a Stripe session identifier in order to deliver the report and meet its tax and accounting obligations. Oliva never receives or stores your card details. Stripe's privacy policy: stripe.com/privacy.

Regulatory authorities: Dubai Land Department (DLD), Real Estate Regulatory Agency (RERA), Financial Intelligence Unit (FIU), UAE Data Office (when operational), the UAE Federal Tax Authority, courts, and law-enforcement where required by law.

Transaction parties (brokerage engagements only): Property developers (off-plan), property sellers and their agents (resale, where applicable), escrow account trustees, and cooperating brokers.

Referral partners (with your consent): Mortgage brokers and banks, property management companies, and inspection or legal service providers. They become independent data controllers under their own privacy policies.

We do not sell, rent, or trade your personal data to third parties for marketing or advertising purposes.

Your personal data may be transferred to and processed in countries outside the UAE in the following circumstances.

United States (Anthropic, Google, Microsoft, Resend, Mapbox, Meta, LinkedIn). Anthropic processes AI prompts and retrieved context in the US. Google (Analytics, Tag Manager, Places) and Microsoft (Clarity) process consented analytics data. Resend processes transactional email. Mapbox processes map-tile requests. Meta and LinkedIn process consented advertising-measurement data.

European Union (iDenfy, Lithuania). For brokerage engagements only, KYC and AML verification data is processed by iDenfy in Lithuania, with GDPR-level protections in the EU and a Data Processing Agreement.

India (Hostinger). Platform infrastructure is hosted on Hostinger servers located in India. Transaction records and usage data are stored on these servers, with contractual data-processing terms and encryption at rest and in transit.

Safeguards. For transfers to countries without a UAE Data Office adequacy determination, we implement binding contractual clauses, encryption in transit and at rest, and (where required) explicit consent. For transfers to the EEA, GDPR-level protections apply. For transfers to the United States, we rely on the relevant service providers' data-protection commitments and Standard Contractual Clauses where applicable.

By using the Platform, you acknowledge that international data transfers may occur as described above. Contact hello@joinoliva.com for information on the specific safeguards applied to any transfer.

The Platform uses cookies and similar tracking technologies, categorized as follows.

Manage your preferences. Use the consent banner displayed on first visit, or open the Cookie Settings link in the footer at any time. Your browser also lets you refuse or delete cookies. Browsing is free and declining analytics and marketing cookies never affects your access to anything, including your ability to purchase and receive the Oliva Underwriting Report.

Controller responsibility. All cookies on the Platform are managed by Oliva DB Properties CO. L.L.C. S.O.C. KYC vendor cookies set during a brokerage transaction (iDenfy) are likewise managed by Oliva.

Full details are in the Cookie Policy.

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law.

• KYC and AML records (brokerage engagements): Minimum 5 years from the end of the business relationship (Federal Decree-Law No. 20 of 2018). KYC verification validity: 3 years.
• Transaction records: Minimum 5 years from transaction completion (AML Law and RERA Bylaw 85).
• RERA forms (A, B, F): 5 years from transaction completion.
• AI generation audit logs: 24 months from generation (PDPL data minimization aligned with customer-service and compliance needs).
• Communication records: 5 years from last communication.
• Cookie-consent records: Until you withdraw consent, plus 3 years.
• Website analytics data: 24 months.
• Payment and transaction records (Oliva Underwriting Report purchases): 7 years from the end of the tax period to which they relate, as required by UAE tax law (Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses and the VAT record-keeping rules under Federal Decree-Law No. 8 of 2017). These records comprise the email address you gave at checkout, the amount paid, the VAT charged, the Stripe session or payment identifier, and the tax invoice. Oliva holds no card details at any point.
• Closing-process records: 5 years from process completion.

After retention periods expire, data is securely deleted or irreversibly anonymized. Exceptions apply where required by ongoing legal proceedings, regulatory orders, or other legal obligations.

Under PDPL, you have the following rights regarding your personal data:

Right to access (Article 13): Request confirmation of whether we process your data and obtain a copy, free of charge.

Right to correction (Article 15): Request correction of inaccurate or incomplete data.

Right to deletion (Article 15): Request deletion where data is no longer necessary, you withdraw consent, or processing is unlawful. We cannot delete data where retention is required by AML law (minimum 5 years).

Right to data portability (Article 14): Receive your data in a structured, machine-readable format and request transmission to another controller.

Right to restrict processing (Article 16).

Right to object (Article 17): Object to processing for direct marketing at any time, with immediate effect.

Right regarding automated decisions (Article 18): Not be subject to decisions based solely on automated processing that produce significant legal effects, without human review.

To exercise any right, email hello@joinoliva.com with your full name, the email address you used to contact us (if any), and a clear description of your request. We respond within one calendar month, extendable by up to two additional months for complex requests.

We use automated processing in the following areas.

KYC verification (brokerage engagements only). iDenfy performs automated document verification. All results are subject to human review before any decision is made about the engagement.

Sanctions and PEP screening (brokerage engagements only). Automated screening against international sanctions lists and PEP databases. All matches are reviewed by our compliance team before action is taken.

Oliva Score. Our scoring engine evaluates projects using algorithmic analysis of data across 6 dimensions and 97 underlying metrics. The Oliva Score is an informational tool to assist your independent analysis. It is not used to make decisions about you or your access to services.

Project matching. Algorithm-assisted matching of projects to your stated preferences and search criteria. This surfaces relevant listings but does not restrict what you can browse.

We do not make decisions based solely on automated processing that produce significant legal effects on you without human involvement. You may request a human-reviewed explanation of any automated output, express your point of view, and contest any automated decision by contacting hello@joinoliva.com.

Where the Platform produces AI-generated content, Oliva processes:

• your prompt and inputs;
• the retrieved context (data points pulled from official Dubai Land Department datasets and licensed third-party data);
• the AI model's output.

Processing is performed using Anthropic's Claude API in the United States. Anthropic is a sub-processor under a written Data Processing Addendum that prohibits use of customer data for model training. Audit-log records of each generation are retained as described in the AI-Generated Content Disclaimer.

You have the right under PDPL (and GDPR, where applicable) to access the audit-log record for any specific AI-generated output and to request a human-reviewed explanation of any output. To request the audit-log record, email hello@joinoliva.com.

We implement appropriate technical and organizational security measures.

Technical measures: TLS 1.3 encryption for data in transit, AES-256 encryption for data at rest, role-based access controls with the principle of least privilege, multi-factor authentication for system access, firewalls and intrusion detection, secure development practices and code review, and regular security assessments.

Organizational measures: Confidentiality agreements for personnel, data-protection awareness training, vendor due diligence and contractual security requirements, physical security controls at our offices, and documented incident-response procedures.

Breach notification. If a personal-data breach could adversely affect your privacy, we will notify the UAE Data Office (and, where applicable, EU supervisory authorities) and notify you directly where the breach poses a serious risk, with details about the nature, likely consequences, and remedial measures.

While we implement robust measures, no method of transmission or storage is completely secure.

The Platform is not directed to anyone under the age of 18 and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, contact hello@joinoliva.com so we can delete it.

Step 1. Contact us at hello@joinoliva.com with your full name, a description of your concern, and your preferred resolution. We acknowledge within 2 business days and respond substantively within 14 days.

Step 2. If you are not satisfied, escalate to senior management at hello@joinoliva.com.

Step 3. You may lodge a complaint with the UAE Data Office (once fully operational) or contact RERA through the Real Estate Violation System.

Step 4 (EEA / UK). You may lodge a complaint with your national data-protection supervisory authority. UK users may lodge with the Information Commissioner's Office (ico.org.uk).

Step 5. Nothing in this policy limits your right to pursue legal remedies in accordance with our Terms of Service.

We may update this Privacy Policy from time to time. Material changes are announced by a notice on the Platform at least 14 days before they take effect. Non-material changes such as clarifications or formatting updates may be made without prior notice.

Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy. If you disagree, exercise your data-subject rights, including the right to deletion (subject to legal retention requirements).

If you are located in the European Economic Area, the European Union, the United Kingdom, or Switzerland, the EU GDPR or the UK GDPR may apply to our processing of your personal data in addition to the PDPL. This section sets out the additional information and rights that apply to you.

14.1 Controller and contact. Oliva DB Properties CO. L.L.C. S.O.C. is the data controller for all activities described in Part 1. For EU/UK data-protection inquiries, contact hello@joinoliva.com. Until a formal EU/UK representative is appointed under Article 27 GDPR, this email address serves as your point of contact.

14.2 Legal bases under GDPR.

• Contract performance (Article 6(1)(b)): Responding to your inquiries and, where you engage Oliva as your broker, provision of brokerage services and transaction facilitation.
• Legal obligation (Article 6(1)(c)): AML/CFT compliance, tax obligations, regulatory reporting (brokerage engagements only).
• Legitimate interests (Article 6(1)(f)): Platform security, fraud prevention, service improvement, analytics. We have conducted balancing tests to ensure our legitimate interests do not override your fundamental rights and freedoms. You may request the assessments.
• Consent (Article 6(1)(a)): Analytics cookies and advertising cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

14.3 Additional rights. EU/UK users have the rights described in Part 8 plus:

• Data portability (Article 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Restriction (Article 18): Request restriction of processing in defined circumstances.
• Object (Article 21): Object to processing based on legitimate interests at any time. We will cease processing unless we demonstrate compelling legitimate grounds. You may object to direct marketing at any time with immediate effect.
• Automated decisions (Article 22): Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Our scoring and matching tools do not produce such decisions.
• Lodge a complaint: with your local supervisory authority (e.g. the Information Commissioner's Office in the UK, or your national DPA in the EU).

14.4 International transfers. Where data is transferred outside the EEA/UK (including to the UAE, India, and the United States), we rely on Standard Contractual Clauses adopted by the European Commission (and UK addendum where applicable), supplementary technical measures including encryption, and (where applicable) adequacy decisions. Request a copy of the SCCs from hello@joinoliva.com.

14.5 Cookies and tracking for EU/UK users. Non-essential cookies (analytics, functional, and marketing) are activated only after explicit consent through our consent banner. You may reject all non-essential cookies with a single action. Consent preferences can be changed at any time. We maintain consent logs as required by the ePrivacy Directive.

14.6 No email marketing. Oliva does not conduct email marketing and holds no marketing mailing lists. Historical outreach data from earlier versions of the product was deleted in August 2026.

14.7 Geographic scope. Oliva primarily targets investors based in the United Arab Emirates, the GCC, the United Kingdom, the United States, and the Asia-Pacific region. Oliva does not market its services to data subjects in the European Economic Area in the targeted manner contemplated by GDPR Article 3(2)(a). Where Oliva nevertheless processes personal data of EEA-based data subjects (for example, where a visitor in the EEA voluntarily contacts us), Oliva applies the safeguards described in this Privacy Policy and respects the rights set out in Part 8 and this Part 14 of this Policy. Oliva will appoint and publish the contact details of an EU representative under GDPR Article 27 at the point at which its activities, in scope or character, fall within Article 3(2) of the GDPR, and will update this Privacy Policy accordingly.

This Privacy Policy is governed by the UAE PDPL and, to the extent not specifically addressed by PDPL, by the laws of the United Arab Emirates as applied in the Emirate of Dubai. For visitors in the EEA, UK, or Switzerland, GDPR or UK GDPR applies where its territorial scope is engaged. Subject to the dispute-resolution provisions in our Terms of Service, the UAE courts and dispute mechanisms identified there have exclusive jurisdiction over disputes arising from this policy.

• General inquiries: hello@joinoliva.com
• Legal and compliance: hello@joinoliva.com
• Data protection: hello@joinoliva.com
• Complaints: hello@joinoliva.com
• Office hours: Monday to Saturday, 9:00 AM to 9:00 PM GST

Oliva: Oliva DB Properties CO. L.L.C. S.O.C., RERA Brokerage Registration Number and Trade Licence Number 1573501, Ontario Tower, C1801, Business Bay, Dubai, United Arab Emirates. TRN 105237083800001. Phone: +971 50 852 1658.