1. Data controller
Performoon OÜ (registry code: 17001386, registered address: Ahtri tn 12, 15551 Tallinn, Estonia) operates My Dubai Residence (mydubairesidence.com) and acts as data controller. Contact: info@dubaingatlan.hu or office@performoon.com.
2. Data we process
Through the contact form you provide your name, email address, phone number, investment budget, preferred location, buying purpose, timing and message. We also record the fact and time of your acknowledgement and the page path. The web server and security systems may process technical data from the HTTP request, such as the IP address, browser and device information and a timestamp. Traffic and campaign parameters are stored in the browser session only after the relevant cookie choice has been made. If you then submit a live form, the current campaign parameters become part of the enquiry and are retained for the same period as the enquiry.
With advertising consent, a completed live enquiry or accepted booking may send Google a SHA-256 hash of your email address and, where supplied in an international format, your phone number for enhanced conversion measurement. Google can match these hashes with its own data to help attribute enquiries to ads. Hashing does not make the data anonymous. We do not send your name, message or raw contact details in website tracking events, and preview form checks are not counted as leads. Booking email matching is available only when Cal.com supplies the attendee’s email in its completion event.
3. Purposes and legal bases
- (a) Responding to your enquiry and preparing a personalised shortlist — pre-contractual steps at your request, GDPR Article 6(1)(b).
- (b) Sharing data with a contracted real estate sales partner — only where needed for the requested shortlist, after the recipient and transfer terms have been disclosed and an appropriate legal basis and transfer mechanism are in place.
- (c) Newsletters and marketing communications — your consent, GDPR Article 6(1)(a).
- (d) Analytics and advertising — your consent given in the cookie banner, GDPR Article 6(1)(a).
- (e) Protecting the website and form against abuse and automated spam — our legitimate interests, GDPR Article 6(1)(f).
4. Recipients (third-party transfers)
An enquiry submitted through the form is not automatically shared with a property sales partner. If preparing the requested shortlist requires us to involve a Dubai- or UAE-based developer, brokerage or local property professional, before any transfer we will tell you the recipient's identity or precise category, the purpose of the transfer, the data involved and the applicable transfer terms. We share data only after the required prior steps have been completed.
5. International transfers
Many of our contracted partners operate outside the European Union, in the United Arab Emirates (UAE). The European Commission has not adopted an adequacy decision for the UAE, so EU data protection law (GDPR) does not apply directly to those partners and EU-level safeguards do not apply automatically.
Before a transfer to the UAE, we assess and, where applicable, use an appropriate safeguard under GDPR Article 46, such as Standard Contractual Clauses. If no such safeguard is available, an occasional transfer may take place only after you have been informed of the specific recipient and risks and have given explicit consent under GDPR Article 49(1)(a). Submitting the website form does not by itself provide that transfer consent.
Where enabled for the service, Resend, which delivers transactional emails, Google LLC (Gmail), which receives lead notifications, and Cal.com, which provides appointment booking, are US-based or globally operating services. Processing outside the European Economic Area is subject to the applicable transfer safeguards, such as the EU–US Data Privacy Framework where available or Standard Contractual Clauses.
6. Contact via WhatsApp and booking
When you contact us on WhatsApp or book an online consultation, we process the data you provide (name, phone number, email address, message content, booking details) to answer your enquiry and prepare an offer, based on GDPR Article 6(1)(b).
A website form, WhatsApp message or booking does not by itself authorise us to share your data with a UAE property sales partner. If such a transfer is needed for the requested shortlist, we first identify the recipient or precise recipient category and explain the transfer terms and risks, then complete the required legal step.
The retention periods, categories of recipients and data subject rights set out elsewhere in this notice apply equally to such enquiries.
7. Retention
For live enquiries, we retain enquiries, including copies held in the notification mailbox, for 24 months from the last substantive contact. They are then deleted from active systems; copies in provider backups may be deleted according to the provider's retention cycle. Data evidencing consent (timestamp, text version and page path) is kept for a reasonable period thereafter to demonstrate compliance. This website’s in-memory rate-limit entry, based on a hash of the IP address, expires after 15 minutes; security logs kept by the hosting and network provider follow that provider's retention schedule.
8. Recipients and service providers
Where enabled for the service, the following recipients and technical service providers are used; some may also act as independent controllers in relation to parts of their services:
- Hosting provider for operating the website and transmitting incoming enquiries.
- MarciCRM — our internal system for recording enquiries, privacy acknowledgements and follow-up activity, hosted on Lovable Cloud/Supabase. Google Calendar is used to organise the team’s follow-up calls.
- Resend (Plus Five Five, Inc., United States) — transactional email delivery for internal lead notifications and confirmations sent to the person submitting an enquiry.
- Google LLC (Gmail) — mailbox provider for the authorised My Dubai Residence recipient; the internal notification contains the information submitted through the form.
- Google — analytics and advertising (Google Analytics, Google Ads), based on consent.
- Cal.com, Inc. (United States) — scheduling online consultations and processing the information needed for a booking.
- Meta / WhatsApp — messaging. WhatsApp communication is subject to Meta's own data practices, which may include processing outside the European Union.
9. Your rights
You have rights of access, rectification, erasure, restriction of processing and data portability, and you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it. You may also object to processing based on legitimate interests.
You may withdraw consent at any time by emailing info@dubaingatlan.hu or office@performoon.com.
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).
10. Deletion requests
Send deletion requests to info@dubaingatlan.hu or office@performoon.com. We fulfil legitimate deletion requests within 30 days of receipt.