Loading...
Loading...
Legal
This Privacy Policy explains how Oliva collects, uses, stores, protects, and shares your personal data when you use the Oliva platform. Two entities operate as data controllers: Oliva Real Estate Technology LLC (Delaware) for the SaaS platform, and Oliva DB Properties CO. L.L.C. S.O.C. (UAE, RERA BRN 1573501) for brokerage transactions. Compliant with the UAE Personal Data Protection Law (PDPL) and, for EU/UK users, GDPR.
Table of Contents
1.1 Two controllers operate the Platform.
Both controllers are wholly owned by Javier Sanz Alvarez. Personal data may flow between the two controllers as needed to provide the integrated user experience. The flows are governed by a written Data Processing Addendum between the two controllers, available on request from hello@joinoliva.com.
1.2 Contact details.
1.3 Scope. This Privacy Policy applies whenever you access joinoliva.com, our mobile applications, or any associated services (collectively, the "Platform"), create an account, use our scoring or matching tools, generate AI Investment Memos, complete KYC, manage your portfolio, or communicate with us through any channel.
1.4 Compliance is with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), and, for users resident in the European Economic Area, the United Kingdom, or Switzerland, the EU GDPR or UK GDPR (described in Part 14).
Identity data: Full legal name, nationality, date of birth, passport details, Emirates ID (UAE residents), visa status, photographs, biometric identifiers collected during KYC verification (facial geometry matched against passport photograph), and signature.
Contact data: Email address, mobile phone, WhatsApp number, residential address, country of residence, tax residency, and proof-of-address documentation.
Financial data: Source-of-funds documentation, bank statements, employment details, salary certificates, investment budget and preferences, and payment history. We do not store credit-card numbers; payment processing is handled by Stripe.
Transaction data: Property search and filter preferences, projects viewed, shortlisted, or dismissed, RERA documentation (Forms A, B, F), Sales and Purchase Agreements, Oqood and DLD registration details, closing-process phases and timelines, and payment records.
Technical data: IP address, browser type and version, device type and operating system, approximate location derived from IP, pages visited, time spent on pages, referral source, and cookie identifiers.
Communication data: Email correspondence, WhatsApp messages, phone-call records, video-call records, survey responses, feedback, and complaint records.
Scoring and engagement data: Oliva Score interactions, project comparison activity, recommendation engagement, financing-calculator inputs, and Data Center usage patterns.
AI memo data: Prompts and inputs you provide, the retrieved context (data points pulled from our verified, Dubai Land Department-sourced dataset) used to ground each AI Investment Memo, the model identifier, and the full output served to you. Audit-log records of each AI generation are described in Part 9A.
Subscription data: Stripe Customer ID, subscription tier and billing interval, payment status, invoices, and tax-jurisdiction data processed by Stripe Tax.
Corporate data (for business clients): Company name, trade license, articles of association, shareholder register, Ultimate Beneficial Owner (UBO) information, board resolutions, and authorized signatory details.
How we collect data. Directly from you when you register, complete KYC, submit offers, or communicate with us. Automatically through cookies, server logs, and platform analytics. From third parties including iDenfy (KYC results), property developers (transaction data), DLD and RERA (registration records), and publicly available sources (sanctions lists, PEP databases).
Service delivery (contractual necessity, PDPL Article 4 / GDPR Article 6(1)(b)): Creating and managing your account, generating personalized project recommendations, producing AI Investment Memos, facilitating offer submission and negotiation, managing the closing process from KYC through to delivery, coordinating Oqood and DLD registration, managing your portfolio dashboard, and processing payments.
Legal and regulatory compliance (legal obligation): Conducting KYC verification through iDenfy, performing Customer Due Diligence and Enhanced Due Diligence, verifying source of funds, maintaining transaction records as required by RERA and DLD, filing Suspicious Activity Reports with the Financial Intelligence Unit via goAML, VAT compliance, UAE corporate-tax compliance, and US tax compliance for Oliva Technology.
Platform improvement (legitimate interest): Analyzing usage patterns to improve scoring, matching, AI memos, and user experience; developing new features; quality assurance and performance monitoring.
Communication (contractual necessity and consent): Transaction updates and closing notifications, project alerts and score updates, customer support, and marketing communications (consent only).
Security and fraud prevention (legitimate interest): Protecting against unauthorized account access, detecting financial crime, monitoring for suspicious activity, and maintaining platform security.
Service providers (data processors):
Inter-entity transfer. Personal data flows between Oliva Technology and Oliva Brokerage as needed to provide the integrated experience, governed by a written inter-controller Data Processing Addendum with data-minimization, contractual safeguards, and encryption.
Regulatory authorities: Dubai Land Department (DLD), Real Estate Regulatory Agency (RERA), Financial Intelligence Unit (FIU), UAE Data Office (when operational), tax authorities (UAE Federal Tax Authority and US Internal Revenue Service for Oliva Technology), courts, and law-enforcement where required by law.
Transaction parties: Property developers (off-plan), property sellers and their agents (resale, where applicable), escrow account trustees, and cooperating brokers.
Referral partners (with your consent): Mortgage brokers and banks, property management companies, and inspection or legal service providers. They become independent data controllers under their own privacy policies.
We do not sell, rent, or trade your personal data to third parties for marketing or advertising purposes.
Your personal data may be transferred to and processed in countries outside the UAE in the following circumstances.
United States (Oliva Technology, Anthropic, Stripe, Stripe Tax, Google, Resend, Mapbox, Meta, LinkedIn). Oliva Technology is a Delaware LLC, so much SaaS-side data is processed in the United States. Anthropic processes AI memo prompts and retrieved context in the US. Stripe processes payment and tax data. Other US providers process analytics, advertising, and email-delivery data.
European Union (iDenfy, Lithuania). KYC and AML verification data is processed by iDenfy in Lithuania, with GDPR-level protections in the EU and a Data Processing Agreement.
India (Hostinger). Platform infrastructure is hosted on Hostinger servers located in India. Account data, transaction records, and usage data are stored on these servers, with contractual data-processing terms and encryption at rest and in transit.
Inter-entity transfer (UAE and US). Personal data is transferred between Oliva Technology (United States) and Oliva Brokerage (UAE) as needed to provide the integrated experience, governed by an inter-controller Data Processing Addendum.
Safeguards. For transfers to countries without a UAE Data Office adequacy determination, we implement binding contractual clauses, encryption in transit and at rest, and (where required) explicit consent. For transfers to the EEA, GDPR-level protections apply. For transfers to the United States, we rely on the relevant service providers' data-protection commitments and Standard Contractual Clauses where applicable.
By using the Platform, you acknowledge that international data transfers may occur as described above. Contact hello@joinoliva.com for information on the specific safeguards applied to any transfer.
We retain personal data only for as long as necessary for the purpose it was collected, or as required by law.
After retention periods expire, data is securely deleted or irreversibly anonymized. Exceptions apply where required by ongoing legal proceedings, regulatory orders, or other legal obligations.
Under PDPL, you have the following rights regarding your personal data:
Right to access (Article 13): Request confirmation of whether we process your data and obtain a copy, free of charge.
Right to correction (Article 15): Request correction of inaccurate or incomplete data.
Right to deletion (Article 15): Request deletion where data is no longer necessary, you withdraw consent, or processing is unlawful. We cannot delete data where retention is required by AML law (minimum 5 years).
Right to data portability (Article 14): Receive your data in a structured, machine-readable format and request transmission to another controller.
Right to restrict processing (Article 16).
Right to object (Article 17): Object to processing for direct marketing at any time, with immediate effect.
Right regarding automated decisions (Article 18): Not be subject to decisions based solely on automated processing that produce significant legal effects, without human review.
To exercise any right, email hello@joinoliva.com with your full name, the email registered on your account, and a clear description of your request. We respond within one calendar month, extendable by up to two additional months for complex requests.
We use automated processing in the following areas.
KYC verification. iDenfy performs automated document verification and facial recognition. All results are subject to human review before any decision is made about your account or access to services.
Sanctions and PEP screening. Automated screening against international sanctions lists and PEP databases. All matches are reviewed by our compliance team before action is taken.
Oliva Score. Our scoring engine evaluates projects using algorithmic analysis of data across 6 dimensions and 97 underlying metrics. The Oliva Score is an informational tool to assist your independent analysis. It is not used to make decisions about you or your access to services.
Project matching. Algorithm-assisted matching of projects to your stated preferences and search criteria. This surfaces relevant listings but does not restrict what you can browse.
We do not make decisions based solely on automated processing that produce significant legal effects on you without human involvement. You may request a human-reviewed explanation of any automated output, express your point of view, and contest any automated decision by contacting hello@joinoliva.com.
Where the Platform produces AI-generated content (including AI Investment Memos), Oliva Technology processes:
Processing is performed using Anthropic's Claude API in the United States. Anthropic is a sub-processor under a written Data Processing Addendum that prohibits use of customer data for model training. Audit-log records of each generation are retained as described in the AI-Generated Content Disclaimer.
You have the right under PDPL (and GDPR, where applicable) to access the audit-log record for any specific AI-generated output and to request a human-reviewed explanation of any output. To request the audit-log record, email hello@joinoliva.com.
We implement appropriate technical and organizational security measures.
Technical measures: TLS 1.3 encryption for data in transit, AES-256 encryption for data at rest, role-based access controls with the principle of least privilege, multi-factor authentication for system access, firewalls and intrusion detection, secure development practices and code review, and regular security assessments.
Organizational measures: Confidentiality agreements for personnel, data-protection awareness training, vendor due diligence and contractual security requirements, physical security controls at our offices, and documented incident-response procedures.
Breach notification. If a personal-data breach could adversely affect your privacy, we will notify the UAE Data Office (and, where applicable, EU supervisory authorities) and notify you directly where the breach poses a serious risk, with details about the nature, likely consequences, and remedial measures.
While we implement robust measures, no method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and notifying us promptly of suspected unauthorized access.
The Platform is not directed to anyone under the age of 18 and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, contact hello@joinoliva.com so we can delete it.
Step 1. Contact us at hello@joinoliva.com with your full name, a description of your concern, and your preferred resolution. We acknowledge within 2 business days and respond substantively within 14 days.
Step 2. If you are not satisfied, escalate to senior management at hello@joinoliva.com.
Step 3. You may lodge a complaint with the UAE Data Office (once fully operational) or contact RERA through the Real Estate Violation System.
Step 4 (EEA / UK). You may lodge a complaint with your national data-protection supervisory authority. UK users may lodge with the Information Commissioner's Office (ico.org.uk).
Step 5. Nothing in this policy limits your right to pursue legal remedies in accordance with our Terms of Service.
We may update this Privacy Policy from time to time. For material changes that significantly affect how we process your personal data, we notify you by email at least 14 days before the changes take effect. Non-material changes such as clarifications or formatting updates may be made without prior notice.
Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy. If you disagree, exercise your data-subject rights, including the right to deletion (subject to legal retention requirements).
If you are located in the European Economic Area, the European Union, the United Kingdom, or Switzerland, the EU GDPR or the UK GDPR may apply to our processing of your personal data in addition to the PDPL. This section sets out the additional information and rights that apply to you.
14.1 Joint controllership and contact. Oliva Technology and Oliva Brokerage each operate as data controller for the activities described in Part 1. For EU/UK data-protection inquiries, contact hello@joinoliva.com. Until a formal EU/UK representative is appointed under Article 27 GDPR, this email address serves as your point of contact.
14.2 Legal bases under GDPR.
14.3 Additional rights. EU/UK users have the rights described in Part 8 plus:
14.4 Cooling-off period. If you are a consumer in the EU or UK, you have a 14-day right of withdrawal from the date of subscription, subject to the digital-services exclusion when the service is fully performed during the cooling-off period and you expressly consented to begin performance and acknowledged the loss of the right of withdrawal. Details are in the Subscription Agreement.
14.5 International transfers. Where data is transferred outside the EEA/UK (including to the UAE, India, and the United States), we rely on Standard Contractual Clauses adopted by the European Commission (and UK addendum where applicable), supplementary technical measures including encryption, and (where applicable) adequacy decisions. Request a copy of the SCCs from hello@joinoliva.com.
14.6 Cookies and tracking for EU/UK users. Non-essential cookies (analytics, functional, and marketing) are activated only after explicit consent through our consent banner. You may reject all non-essential cookies with a single action. Consent preferences can be changed at any time. We maintain consent logs as required by the ePrivacy Directive.
14.7 Geographic scope. Oliva primarily targets investors based in the United Arab Emirates, the GCC, the United Kingdom, the United States, and the Asia-Pacific region. Oliva does not currently market its services to data subjects in the European Economic Area in the targeted manner contemplated by GDPR Article 3(2)(a). Where Oliva nevertheless processes personal data of EEA-based data subjects (for example, where a user in the EEA voluntarily creates an account), Oliva applies the safeguards described in this Privacy Policy and respects the rights set out in Part 8 and this Part 14 of this Policy. Oliva will appoint and publish the contact details of an EU representative under GDPR Article 27 at the point at which its activities, in scope or character, fall within Article 3(2) of the GDPR, and will update this Privacy Policy accordingly.
This Privacy Policy is governed by PDPL and, to the extent not specifically addressed by PDPL, by the governing-law provisions of the relevant Oliva entity. Subject to the dispute-resolution provisions in our Terms of Service (split between Delaware for SaaS-side disputes and the UAE for brokerage-side disputes), the courts and arbitration mechanisms identified there have exclusive jurisdiction over disputes arising from this policy.
Oliva Technology: Oliva Real Estate Technology LLC, 8 The Green, Ste A, Dover, DE 19901, EIN 32-0830351.
Oliva Brokerage: Oliva DB Properties CO. L.L.C. S.O.C., RERA Brokerage Registration Number and Trade Licence Number 1573501, Ontario Tower, C1801, Business Bay, Dubai, United Arab Emirates. TRN 105237083800001. Phone: +971 50 852 1658.
Get personalised advice on your investment goals, financing options, and the best areas to invest in Dubai right now.