Privacy Policy

1. Data Controller

The data controller is Insha'at, registered in Al Ain, United Arab Emirates. We are responsible for how your personal data is collected, used, and protected under the UAE Personal Data Protection Law. Our registered address is available upon request through the contact details below.

2. Data We Collect

2.1 Data You Provide

• Account Data: Name email phone number profile picture
• Business data: Business data tax registration
• Verification data: Kyc documents rera dld
• Project data: Project specifications location
• Platform payment data: Subscription and lead fee

2.2 Automatically Collected Data

• Device, browser, and operating system data.
• Addresses and usage logs
• Approximate geolocation city level

3. Purpose of Processing

• Operating the platform and facilitating transactions between parties
• Verifying user identity, trade licenses, and professional credentials
• Managing subscriptions and lead-fee billing
• Sending operational notifications (account activity, bid updates, payment reminders)
• Complying with legal, tax, and regulatory obligations
• Improving the platform and user experience through analytics

4. Legal Basis for Processing

We process your personal data based on: (a) performance of the contract between you and the Platform; (b) your explicit consent when required; (c) legal obligations (including tax, AML, and regulatory compliance); (d) legitimate interest in operating the Platform, ensuring security, preventing fraud, and improving services, in accordance with Article 5 of the UAE PDPL.

5. Data Retention

Data Type	Retention period
Account Data	Duration account days post
Platform fee invoice records	5 years uae tax requirements
Compliance & AML Records	5 years
Usage data	2 years then anonymized
In platform message logs	1 year

6. Sharing with Third Parties

Not sell your personal

• Transaction Counterparty: Share necessary information
• Payment providers: Tap, Tabby, and Tamara for payment processing
• Optional escrow partners: Telr and paytabs only
• Realtime broadcasting: Laravel reverb pusher for
• Verification services: Apis for trade license
• Hosting infrastructure providers: For data storage and platform operation
• Regulatory judicial authorities: Upon lawful request including

7. Data Security

• TLS 1.2+ encryption for all data transmissions.
• Aes 256 encryption for
• Two factor authentication 2fa available
• Strict role based access controls
• Continuous security monitoring and

8. Your Rights under PDPL

Under the uae pdpl

• Right of Access — Request copy your personal
• Right to correction — Correct inaccurate or incomplete data
• Right to deletion — Request deletion your data
• Right to portability — Receive your data structured
• Right to restrict processing — Request restriction processing
• Right to object — Object processing for direct
• Right to withdraw consent — Withdraw your consent any
• Right to complain — File complaint with the

To exercise any of these rights, please contact our Data Protection Officer (DPO) at privacy@inshaat.ae. We will respond to your request within 30 days in accordance with PDPL requirements.

9. International Data Transfers

Some of your data may be stored or processed outside the UAE via infrastructure or verification providers (including but not limited to cloud hosting, CDN, and email delivery services). In such cases, we ensure appropriate safeguards in accordance with Article 22 of the PDPL, including standard contractual clauses, adequacy decisions where applicable, and equivalent protection measures. A list of sub-processors is available upon request.

10. Cookies

Use essential cookies necessary for the platform to operate

11. Children's Privacy

The Platform is intended for users aged 18 or above. We do not knowingly collect data from children. If we become aware, we will delete it immediately.

12. Changes to This Policy

We may update this policy. We will notify you 30 days before any material change via email and in-platform notice.

13. Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the UAE Data Protection Authority and affected users without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of affected data subjects, the likely consequences, and the measures taken or proposed to address the breach.

14. Automated Decisions

We may use automated decision-making and profiling for the following purposes: (a) fraud detection and prevention; (b) AML and sanctions screening; (c) spam and abuse detection; (d) relevance scoring of listings and matches. Decisions that produce legal effects or similarly significant effects concerning you are not taken solely by automated means without human intervention, except where necessary for fraud prevention with appropriate safeguards. You have the right to contest any automated decision and request human review.

15. Profiling

We may create profiles based on your usage of the Platform, including project types, service categories, geographic preferences, and interaction history. This profiling is used to improve match quality, personalize your experience, and provide relevant recommendations. Profiling does not result in decisions that produce legal effects concerning you without human intervention.

16. Marketing Consent

With your explicit consent, we may send you marketing communications about Platform features, promotional offers, and industry updates. You may withdraw your consent and opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting our DPO. Even if you opt out of marketing, we will continue to send you transactional and service-related communications that are necessary for the performance of our contract.

17. Third-Party Cookies

We use essential cookies necessary for the operation of the Platform, as well as analytics and preference cookies to understand usage and improve functionality. Third-party service providers (such as analytics and advertising partners) may also place cookies on your device. You can manage your cookie preferences through your browser settings. For more information, please see our Cookie Policy.

18. Minors

The Platform is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to remove that information from our servers.

Data Protection Officer (DPO)