BuyOrSell.ae Privacy Policy

Souq Labs Technologies LLC SPC ("BuyOrSell", "we", "us", "our") operates the online classifieds platform at www.buyorsell.ae, registered in Abu Dhabi, United Arab Emirates. We are the data controller for personal data processed through the Platform.

This Privacy Policy explains how we collect, use, share, retain, and protect your personal data when you access or use the Platform, and describes your rights under the UAE Federal Decree-Law No. 45/2021 on Personal Data Protection ("PDPL") and other applicable privacy laws.

If you have any questions or concerns, please contact us: contact@buyorsell.ae.

This Policy applies to:

• All users of the Platform, including visitors, registered account holders, buyers, sellers, landlords, tenants, employers, job seekers, and business users.
• Personal data collected through the website at www.buyorsell.ae, our mobile applications, and any related services.
• Data collected via communications with us (email, phone, in-app messaging, support tickets).

This Policy does not apply to third-party websites, applications, or services linked from the Platform. We encourage you to read the privacy policies of any third-party services you use.

We collect personal data in three main ways: data you provide to us directly, data collected automatically, and data received from third parties.

3.1 Data You Provide Directly

3.2 Data Collected Automatically

When you use the Platform, we automatically collect technical and usage data, including:

• Device data: IP address, device type, operating system, browser type and version, screen resolution.
• Usage data: Pages visited, listings viewed, search queries, filters applied, time spent on pages, click patterns, and referral URLs.
• Location data: General location inferred from IP address (emirate level). We do not collect precise GPS location unless you explicitly grant permission for location-based features.
• Cookie and tracking data: Session identifiers, analytics identifiers, advertising identifiers. See Section 10 (Cookie Policy) for full details.
• Transaction logs: Subscription purchases, renewal dates, payment status, and refund requests.

3.3 Data Received from Third Parties

• Social login providers: If you register or log in using Google or Apple, we receive your name, email address, and profile photo from those services.
• Payment processors: Stripe may share transaction confirmation, fraud risk scores, and card verification status.
• Advertising partners: Google Ads and Meta may share audience segment data for ad targeting and measurement.
• Verification services: Where we use third-party identity or licence verification services, we receive confirmation results.

We process your personal data only where we have a lawful basis to do so under the PDPL and applicable UAE law. The table below sets out our processing activities and the lawful basis for each.

Marketing opt-out: You may unsubscribe from marketing emails at any time by clicking "Unsubscribe" in any marketing email, or by updating your notification preferences in Account Settings → Notifications.

We do not sell your personal data to third parties. We share data only as described below.

5.1 Visible to Other Users

Certain data is inherently visible to other Platform users as part of the classifieds service:

• Your display name, profile photo (if set), general location (emirate), and listing content.
• Your review submissions (attributed to your display name).
• Business users: Business name, logo, website, and verified status badge.

5.2 Service Providers

We share data with trusted third-party service providers who process data on our behalf, under strict data processing agreements:

5.3 Legal Disclosures

We may disclose your personal data to government authorities, regulators, law enforcement agencies, or courts where we are required or permitted to do so by applicable UAE law, including:

• To comply with a legal obligation, court order, or regulatory requirement.
• To protect the rights, property, or safety of BuyOrSell, our users, or the public.
• To investigate or prevent fraud, illegal activity, or violations of our Terms.

5.4 Business Transfers

If we are involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.

The Platform is operated from the UAE, and your data is primarily stored on UAE-based servers. Some of our service providers (including Google, Meta, Stripe, and Twilio) may process your data in data centres located outside the UAE, including in the European Union, United States, and other countries.

When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities.
• Adequacy decisions where the destination country offers equivalent protection.
• Binding corporate rules where applicable for intra-group transfers.

You may request information about the safeguards we use for international transfers by contacting us at the details in Section 14.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The table below summarises our key retention periods.

After the applicable retention period, we will securely delete or anonymise your personal data. Where anonymisation is not possible, we will restrict processing until deletion is feasible.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, destruction, or accidental loss. Our security measures include:

• Encryption in transit: All data transmitted between your device and our servers is protected using TLS 1.2+ (HTTPS).
• Encryption at rest: Sensitive data, including payment information and identity documents, is encrypted at rest using AES-256 encryption.
• Password security: User passwords are hashed using industry-standard one-way algorithms (bcrypt). We do not store plain-text passwords.
• Access controls: Access to personal data is restricted to authorised employees and contractors who need it to perform their duties, subject to confidentiality obligations.
• Two-factor authentication (2FA): Available for all accounts and strongly recommended.
• Regular security testing: We conduct regular vulnerability assessments, penetration testing, and security audits.
• Incident response: We maintain a data breach response plan and will notify affected users and the relevant UAE authority within the timeframes required by the PDPL in the event of a significant breach.

Your responsibility: We cannot guarantee absolute security. You are responsible for keeping your account credentials confidential, using a strong unique password, and notifying us immediately at support@buyorsell.ae if you suspect any unauthorised access to your account.

Under UAE Federal Decree-Law No. 45/2021 (PDPL) and applicable law, you have the following rights in relation to your personal data:

How to exercise your rights: Submit a request by emailing contact@buyorsell.ae with the subject line "Data Subject Request". We will respond within 7-15 business days of receipt. We may need to verify your identity before processing your request. Some requests may be subject to exemptions under applicable law.

Account self-service: Many rights can be exercised directly within the Platform via Account Settings → Privacy. You can download your data, delete your account, or update your preferences at any time.

We use cookies and similar tracking technologies to operate and improve the Platform. For full details, including the types of cookies used, how to manage your preferences, and third-party providers, please refer to our Cookie Policy in Section 14 of our Terms and Conditions, available at www.buyorsell.ae.

Cookie consent: On your first visit, we display a consent banner allowing you to accept all cookies, reject non-essential cookies, or manage granular preferences. Essential cookies cannot be disabled as they are required for the Platform to function. You may update your cookie preferences at any time via Account Settings → Privacy → Cookie Preferences.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children under the age of 18.

If we become aware that we have collected personal data from a child under 18 without appropriate parental or guardian consent, we will take immediate steps to delete that data from our systems.

If you are a parent or guardian and believe your child has provided personal data to us without your consent, please contact us at support@buyorsell.ae so we can take appropriate action.

We comply with the UAE Child Digital Safety Law and do not serve behavioural advertising to users identified as being under 18.

The Platform may contain links to third-party websites, social media platforms, or services not operated by us (for example, external payment pages, social login providers, or advertiser websites).

This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices or content of any third-party sites. We encourage you to read the privacy policy of each third-party website or service you visit.

Where you use social login (Google or Apple), the relevant platform's privacy policy also applies to the data they share with us.

We may update this Privacy Policy from time to time to reflect changes in our data practices, technology, or applicable law. We will notify you of material changes by:

• Posting the updated Policy on the Platform with a revised "Last Updated" date; and
• Sending an email notification to your registered email address (for significant changes affecting your rights).

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: