Privacy Policy

Your rental application involves personal and financial information. This policy explains what Fidora collects, why we use it, who receives it and how you can exercise your privacy rights.

It applies when you visit our website, make an enquiry, submit an application, use our platform or contact our team. It also covers landlords, property managers and other individuals whose information we receive in connection with these services.

Privacy at a glance

• We collect information relevant to your enquiry, application and use of Fidora.
• We use it to support your rental payment journey, operate our services and meet applicable obligations.
• We limit sharing to information relevant to a lawful purpose.
• Optional marketing choices are separate from your application.
• You can ask about your information and exercise your privacy rights without creating a Fidora account.

1. Who is responsible for your information?

Fidora is operated by Prop Flow Technologies Limited, a company incorporated in the Dubai International Financial Centre, United Arab Emirates.

Licence number: CL 13845

Registered address:

GA-00-SZ-L1-RT-208 Level 1

Gate Avenue - South Zone

Dubai International Financial Centre

Customer support: support@fidora.ae

Privacy enquiries: privacy@fidora.ae

Requests to exercise your rights: support@fidora.ae

For website, enquiry and platform activities whose purposes and methods we determine, Prop Flow Technologies Limited acts as the data controller.

Our handling of personal information is governed by applicable data-protection law, including DIFC Data Protection Law No. 5 of 2020, as amended, and its applicable regulations.

A regulated financial institution assessing or providing your financing is responsible for its own processing under its privacy notice. We will identify the institution involved before the relevant application information is shared.

2. What information do we collect?

Depending on how you use Fidora, relevant information may include:

Identity and contact details

Your name, contact information, date of birth, nationality, residency information and identity documents.

Application and financial information

Employment details, income evidence, bank statements, financial commitments and assessment information made available through the authorised application process.

Rental information

Property address, annual rent, payment schedule, tenancy documents and relevant landlord or property-manager details.

Service records

Enquiries, correspondence, application status, documents submitted, support requests, complaints and records of notices, authorisations or permissions.

Technical information

IP address, browser and device information, access logs and information about how you use the website.

Preferences

Marketing choices, cookie settings and other preferences you provide.

We request information according to the service you use. We do not need every category from every visitor.

3. Where does the information come from?

Most information comes directly from you.

We may also receive relevant information from an authorised broker or property manager, your landlord, a verification provider or the financial institution involved in your application.

Where verification against an employer, bank, credit bureau or another source is needed, the applicable process and any required authorisation will be explained.

If we obtain your information indirectly, we will provide the required privacy information within the applicable period, unless a lawful exception applies.

If you share another person's information, ensure that you are entitled to do so and direct them to this policy.

4. Why do we use your information?

We identify a lawful basis for each purpose rather than relying on a single permission for every activity.

• Respond to your enquiry and take application steps you request — Steps towards a contract
• Provide your account, application support and customer service — Performance of a contract
• Protect accounts, detect misuse and investigate fraud — Legitimate interests in protecting users and our service
• Maintain records or respond to a binding legal requirement — Compliance with an applicable legal obligation
• Handle disputes and establish or defend legal claims — Legitimate interests or applicable legal obligations
• Understand service performance and improve usability — Legitimate interests for limited operational analysis; consent for optional tracking where required
• Send optional promotional communications — Your consent

Where we rely on legitimate interests, we assess the purpose, necessity and effect on your rights. You may object to this processing.

If required information is not provided, we may be unable to progress the relevant application or service. We will explain when information is necessary and the consequences of not providing it.

5. Sensitive information and identity checks

Identity and financial documents require careful handling. Some verification methods may also involve special-category information, such as biometric information used to identify you uniquely.

If a proposed process requires such information, we will explain the purpose, the organisation conducting the check and the applicable legal basis, including explicit consent where required.

Please do not submit unrelated medical information or other sensitive material. Contact us if you are unsure what a requested document should contain.

6. Who may receive your information?

We limit sharing to information relevant to the purpose.

Recipients may include:

• The financial institution involved in assessing and administering your application.
• Technology and service providers supporting hosting, document handling, communications, verification and customer support.
• Your landlord, broker or property manager, where relevant to verifying or coordinating the tenancy and payment arrangement.
• Professional advisers, auditors and authorities where disclosure is necessary and lawful.
• Parties involved in a proposed business transfer, subject to appropriate confidentiality and data safeguards.

Landlord or broker involvement does not give them unrestricted access to your financial documents. Sharing your full bank statements or credit information is not a routine part of coordinating a tenancy.

Organisations processing information on our instructions are subject to appropriate contractual requirements. Independent organisations remain responsible for their own processing.

7. Where is information processed?

Information may be processed in the DIFC and in other locations used by the organisations involved in providing the service.

Where information is transferred outside the DIFC, we use an applicable transfer mechanism, such as recognised adequacy arrangements or appropriate contractual safeguards, and assess the transfer where required.

Contact privacy@fidora.ae to ask about relevant processing locations or obtain information about the safeguards used.

8. How long do we retain information?

We retain information for a defined purpose, not indefinitely simply because it has been collected.

The relevant period depends on whether you made an enquiry, completed an application, used a service or raised a complaint, and whether legal or dispute-related retention is necessary.

Our retention decisions consider:

• The time needed to deal with your enquiry or deliver the service.
• Applicable record-keeping requirements.
• The need to establish or defend legal claims.
• Security and fraud-prevention needs.
• Your privacy choices and valid rights requests.

When continued retention is no longer justified, we delete or anonymise the information, or otherwise handle it as permitted by law.

You can request details of the retention criteria relevant to your records by contacting privacy@fidora.ae.

9. Cookies and marketing

Necessary cookies support functions such as security and maintaining your session.

Where we use optional analytics or advertising technologies, you can accept, reject or manage them through Cookie settings. Optional technologies will not be activated before the required choice has been obtained.

Cookie details: Link and inventory of technologies, providers, purposes and durations — to be confirmed.

Promotional emails, SMS and WhatsApp messages are optional. You can withdraw marketing consent using the available unsubscribe method or by contacting support@fidora.ae.

Stopping marketing does not stop necessary communications about an application, security issue or service you have requested.

10. Automated tools and decisions

Technology may help organise information, check document completeness and route an application.

A calculator result is an illustration, not an automated financing approval.

If a process involves a solely automated decision that has a legal or similarly significant effect on you, you will receive the applicable information about that process, its significance and available safeguards. Where applicable, you can request human intervention, explain your position and challenge the decision.

11. How do we protect information?

We apply technical and organisational measures appropriate to the information and risks involved. These address access permissions, confidentiality, service-provider handling and incident response.

No online service can eliminate every security risk. Please protect your account credentials and use the designated document-submission process.

If a personal-data incident requires notification, we will notify the relevant authority and affected individuals as required by law.

12. What are your privacy rights?

Depending on the circumstances and applicable law, you may exercise the following rights:

Access your information

Ask whether we hold information about you and request a copy, together with information about its use.

Correct inaccurate information

Ask us to update information that is inaccurate or incomplete.

Delete information

Ask for deletion where the applicable conditions are met.

Restrict processing

Ask us to limit certain uses while an accuracy, lawfulness or objection issue is considered, where applicable.

Object to processing

Object to processing based on legitimate interests and to the use of your information for direct marketing.

Receive portable information

Request qualifying information in a structured, commonly used, machine-readable format where the right applies.

Withdraw consent

Withdraw a permission you previously gave. This does not invalidate processing that lawfully took place before withdrawal.

Question an automated decision

Where applicable, request human intervention, express your view and contest a solely automated decision that has a legal or similarly significant effect.

You will not be penalised for exercising your rights. If a request means that we can no longer perform a service requiring the information, we will explain that consequence.

13. How do you submit a rights request?

Email support@fidora.ae with the subject line "Privacy rights request". You can also write to our registered address, marked for the attention of the Privacy Team.

Online request form: To be confirmed.

You do not need to sign in or create a Fidora account to make a request.

Tell us:

• Your name and preferred contact method.
• The right you wish to exercise or the information you need.
• Your application reference, if available.
• Any details that will help us identify the relevant records.

We may ask for proportionate information to verify your identity or clarify your request. Please do not send a full identity document unless we explain why it is needed and provide an appropriate submission method.

An authorised representative may contact us for you, subject to verification of their authority.

14. How and when will we respond?

We will explain how your request will be handled and respond within the applicable legal period.

Access and correction requests are normally handled within one month. Where the law permits an extension for a complex request or numerous requests, we will notify you within that period, explain the reason and confirm the revised timeframe. Such an extension may be up to a further two months where permitted.

Requests are normally free. If a legal exception allows a reasonable fee or refusal, we will explain the basis rather than applying an automatic charge.

Where we cannot fulfil a request in full, we will explain the reason to the extent legally permitted and identify available next steps.

15. Are there limits to a request?

Some information may need to be retained or withheld because of an applicable legal obligation, another person's rights, or the establishment or defence of a legal claim.

Deleting your Fidora account or withdrawing marketing consent does not cancel your tenancy, financing agreement or outstanding obligations.

We can act on information under our control and coordinate relevant requests with our service providers. If another organisation independently controls the information, it may need to respond under its own process. We will help identify the relevant contact where we can.

This may apply to financing assessments and repayment records, landlord records or credit-bureau information.

16. How do you report a privacy concern?

If you believe information has been sent to the wrong person, accessed without permission or used inappropriately, contact privacy@fidora.ae.

Include a brief description, when it happened and any relevant reference. Do not include passwords, one-time passcodes or full card details.

We will assess the concern and take appropriate action.

You may also raise a complaint directly with the DIFC Commissioner of Data Protection. Contact details and the current complaints process are available on the Commissioner's official website.

You do not have to complete Fidora's complaints process before approaching the Commissioner. Your other legal rights and remedies remain available.

17. Children's information

Fidora's application services are intended for adults who meet the applicable eligibility requirements. Please do not submit children's information unless specifically requested for a necessary and lawful purpose.

Contact privacy@fidora.ae if you believe a child has provided information inappropriately.

18. Updates and contact

We update this policy when our processing or legal requirements change. The date above identifies the latest version. We will provide additional notice of material changes where appropriate and obtain fresh consent where required.

Prop Flow Technologies Limited — Fidora

Licence number: CL 13845

GA-00-SZ-L1-RT-208 Level 1

Gate Avenue - South Zone

Dubai International Financial Centre

Privacy questions and concerns: privacy@fidora.ae

Rights requests and customer support: support@fidora.ae