Privacy Policy

1. Introduction

Welcome to RentIncreaseUAE.com ("we", "us", "our"). We operate a free online platform providing Dubai and UAE tenancy calculators, rent increase guides, Ejari fee information, RERA legal resources, and related property tools for tenants and landlords across the UAE.

We are committed to protecting and respecting your privacy in full compliance with applicable UAE and international data protection law. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we may share it with, how long we retain it, and your rights as a data subject.

This policy applies to all visitors and users of RentIncreaseUAE.com and all associated subpages, calculators, guides, and linked resources on this domain. It covers both UAE-resident users (protected under UAE Federal Decree-Law No. 45 of 2021 — the Personal Data Protection Law, "PDPL") and EU/EEA-resident users (protected under the General Data Protection Regulation — "GDPR").

By using this website, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the website.

2. Who We Are (Data Controller)

RentIncreaseUAE.com is an independent online information and calculator platform focused on UAE rental law, RERA regulations, Ejari, and tenant rights. For the purposes of UAE Federal Decree-Law No. 45 of 2021 (PDPL) and the EU General Data Protection Regulation (GDPR) where applicable, we act as the data controller for all personal data processed via this website.

As a data controller, we determine the purposes and means of processing your personal data. We are responsible for ensuring that all processing activities comply with applicable data protection laws, including the UAE PDPL and GDPR. Where we engage third-party service providers to process data on our behalf, they act as data processors under written data processing agreements.

For all privacy-related questions, requests, or concerns, please use the contact details provided in Section 19.

3. What Data We Collect

We apply the principle of data minimisation — we collect only the minimum amount of personal data required to operate this website and deliver a high-quality user experience. The following categories of data may be collected:

3.1 Data You Provide Voluntarily

• Calculator inputs: Numerical values you enter into any rent, Ejari, housing fee, or DEWA calculator on this site (e.g. rent amounts, property type, area, contract duration). These values are processed entirely within your browser using JavaScript and are never transmitted to, logged by, or stored on our servers at any point.
• Contact form submissions: When you contact us via our contact form or direct email, we collect your name, email address, and the content of your enquiry. This data is used solely to respond to your query.
• Newsletter / email subscriptions: If you voluntarily subscribe to updates or guides, we collect your email address, your consent timestamp, and your subscription source. You may unsubscribe at any time via any email we send.
• Feedback or survey responses: If you choose to submit optional feedback via any on-site survey, we may collect the text of your response and the date of submission. Participation is entirely voluntary and always anonymous unless you choose to identify yourself.

3.2 Data Collected Automatically

• Usage and behavioural data: Pages visited, time on page, scroll depth, clicks, browser type and version, device type (desktop/tablet/mobile), operating system, and screen resolution — collected via analytics tools only with your prior consent.
• Technical data: Referring URL, language settings, and session duration. This information is used in aggregate to improve website performance and content relevance.
• Approximate geographic location: Country and city-level location inferred from IP address for aggregate audience analytics. No precise GPS or fine-grained location data is ever collected.
• IP address: Automatically logged by our hosting servers and security tools for DDoS mitigation, fraud detection, and abuse prevention. Not used for individual profiling.
• Cookies and tracking technologies: See Section 7 for full details on what cookies we use and how to control them.

3.3 Sensitive Personal Data

We do not intentionally collect any sensitive personal data as defined under Article 1 of UAE Federal Decree-Law No. 45 of 2021, including data relating to racial or ethnic origin, political opinions, religious beliefs, health, biometric data, or financial account details. If you include any such information in a contact message to us, we will handle it with heightened care and delete it once your enquiry has been resolved, unless retention is required by law.

4. How We Collect Your Data

Personal data is collected through the following means, all of which are disclosed transparently to you:

• Direct interaction: When you email us, complete a contact form, subscribe to our newsletter, or submit optional feedback. In each case, you actively choose to provide your data.
• Automated technologies: Certain technical data (server logs, IP addresses) is collected automatically when you access the website, as a necessary function of internet communication and server security.
• Consent-gated analytics: Analytics tools such as Google Analytics are only activated on your device after you provide explicit opt-in consent via our cookie consent banner. Prior to consent, no third-party tracking scripts are loaded.
• Third-party CDN services: Certain infrastructure services (e.g. Cloudflare CDN, Font Awesome icon library) may process your IP address as part of delivering website content to your device. These are covered in Section 8.

We do not purchase, rent, or obtain personal data from data brokers, list vendors, or any third-party data sources. All personal data we hold has been provided directly by you or collected via automated means as described above.

5. How We Use Your Data

We use personal data only for specific, documented, and legitimate purposes. The table below sets out each use case, the data involved, and the legal basis:

6. Legal Basis for Processing

Under UAE Federal Decree-Law No. 45 of 2021 (PDPL) — now in active enforcement — all data processing activities must have a documented legal basis. We process your personal data on the following legal grounds:

• Consent (Article 5, UAE PDPL / Article 6(1)(a) GDPR): For optional analytics cookies, preference cookies, and newsletter subscriptions. Consent is always obtained via a clear opt-in mechanism before any such processing begins. You can withdraw consent at any time by using our Cookie Settings tool or unsubscribing from our mailing list.
• Legitimate interests (Article 5, UAE PDPL / Article 6(1)(f) GDPR): For server security logging, DDoS mitigation, fraud prevention, and aggregate internal analytics that do not override your fundamental privacy rights. We have conducted a Legitimate Interests Assessment (LIA) for each such use.
• Legal obligation (Article 5, UAE PDPL / Article 6(1)(c) GDPR): Where we are required to retain, process, or disclose data to comply with UAE federal law, respond to lawful authority requests, or meet statutory record-keeping requirements.
• Contract performance (Article 5, UAE PDPL / Article 6(1)(b) GDPR): Where you have entered into a service relationship with us (such as a newsletter subscription or account registration), to fulfil the obligations of that relationship.

If you are an EU/EEA resident, the GDPR applies in parallel with the above, and you may rely on the same or equivalent protections under EU law. For any processing based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Cookies & Tracking Technologies

We use cookies and similar technologies in compliance with the UAE PDPL, the 2026 UAE Cybersecurity Framework, and GDPR principles. All non-essential tracking requires your prior, explicit, informed consent.

7.1 What Are Cookies?

Cookies are small text files placed on your device by a website's server when you visit. They allow websites to recognise returning visitors, remember preferences, and collect anonymous usage statistics. Similar technologies include web beacons, local storage, and session tokens.

7.2 Cookie Categories We Use

7.3 Consent Management

On your first visit, you will see a cookie consent banner that clearly describes each non-essential cookie category and requires your active, affirmative action (clicking "Accept") before any non-essential cookies are set. Pre-checked boxes, implied consent, and bundled consent are not used. You can view, update, or withdraw your cookie preferences at any time by clicking "Cookie Settings" in the website footer.

7.4 How to Control or Disable Cookies

In addition to our on-site consent tool, you can manage cookies directly in your browser settings. Most modern browsers allow you to block, delete, or review all cookies stored by websites. Note that disabling strictly necessary cookies may impair some basic functionality. For guidance on browser-level cookie management, visit allaboutcookies.org.

8. Third-Party Services & Processors

We engage a small number of carefully vetted third-party services to support the operation, delivery, and security of this website. All third-party processors are bound by data processing agreements. Non-essential third-party scripts are disabled by default and only activated with your consent.

9. Data Sharing & Disclosure

We do not sell, rent, trade, license, or otherwise transfer your personal data to any third party for commercial purposes. This is a firm and unconditional commitment.

Personal data may be shared only in the following strictly limited circumstances:

• Authorised service providers: Trusted third-party vendors who process data on our behalf solely to provide specific services (hosting, analytics, email delivery). All such processors are bound by data processing agreements under Articles 14–15 of UAE Federal Decree-Law No. 45 of 2021 and are prohibited from using your data for their own independent purposes.
• Legal and regulatory obligations: Where we are required by applicable UAE law, court order, or lawful regulatory authority request to disclose specific information. We will notify you of such disclosure where legally permissible and where it would not compromise a legal investigation.
• Protection of rights and safety: Where reasonably necessary to detect, prevent, or address fraud, security breaches, technical failures, or threats to the safety of any individual or the public.
• Business transfers: In the unlikely event of a merger, acquisition, restructuring, or sale of the website or its assets, your data may be transferred to the successor operator. We will provide at least 30 days' advance notice via a prominent website notice and (where applicable) direct email to newsletter subscribers, and your continued use of the website after that period constitutes acceptance of the transfer.

In all cases of sharing, we apply the principle of minimum necessary disclosure — we do not share more data than is strictly required for the specific, documented purpose.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy or as required by UAE law or other applicable legal obligations. Retention periods are documented in our internal processing register.

When data reaches the end of its retention period, it is securely deleted or anonymised using industry-standard methods so that it can no longer be attributed to any individual. We do not retain data "just in case" — retention is always purpose-limited and reviewed annually.

11. Data Security

We implement robust technical and organisational security measures proportionate to the type and sensitivity of data we process, in accordance with the UAE PDPL (Article 16), the 2026 UAE Cybersecurity Framework (Federal Decree-Law No. 34 of 2021), and industry best practices.

11.1 Technical Measures

• TLS/SSL Encryption (HTTPS): All data in transit between your browser and our servers is encrypted using TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS.
• Cloudflare DDoS Protection: Our infrastructure is protected against distributed denial-of-service attacks and malicious traffic via Cloudflare's security layer.
• Token-based authentication: Server-side administrative access is secured with time-limited tokens and multi-factor authentication, in line with 2026 UAE cybersecurity guidelines.
• Input validation and sanitisation: All server-side data inputs are validated and sanitised to prevent injection attacks (SQL injection, XSS, CSRF).
• Regular patching and updates: Software dependencies, server components, and security tools are updated promptly when patches are released.

11.2 Organisational Measures

• Access to stored personal data is restricted to authorised personnel only, on a strict need-to-know basis.
• Third-party service providers are assessed for their own security standards before engagement and reviewed annually.
• We conduct periodic internal security reviews and vulnerability assessments.
• Data minimisation practices mean that the volume of personal data at risk is kept as small as possible at all times.

12. Your Rights as a Data Subject

Under UAE Federal Decree-Law No. 45 of 2021 (PDPL) — now actively enforced — and the GDPR where applicable, you are entitled to exercise the following rights in respect of any personal data we hold about you:

To exercise any of these rights, submit a written request to us using the contact details in Section 19. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. In complex cases, we may extend this period by a further 30 days with written notice. We may need to verify your identity before processing your request. There is no charge for exercising your rights unless your requests are manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable administrative fee or decline the request, with written justification.

13. International Data Transfers

Certain third-party service providers (including Google Analytics and our hosting infrastructure) may store or process your data in jurisdictions outside the UAE, including the United States and the European Economic Area (EEA). Under the UAE PDPL (Articles 22–26), international transfers of personal data to countries without an adequate level of data protection require appropriate safeguards.

Where international transfers occur, we ensure the following safeguards are in place:

• Standard Contractual Clauses (SCCs): We rely on SCCs approved by the relevant data protection authority for transfers to jurisdictions without an adequacy decision.
• Certified Privacy Frameworks: Where available, we use providers that hold certifications under recognised cross-border transfer frameworks (e.g. Google's participation in the EU–US Data Privacy Framework and its IP anonymisation commitments).
• Data Minimisation in Transfers: We enable IP anonymisation in Google Analytics and ensure that only aggregate, non-identifiable data is transferred internationally wherever technically possible.
• Adequacy assessments: We monitor the UAE Data Office's ongoing work to publish adequacy determinations for third countries and will update our transfer mechanisms accordingly when those determinations are published.

For EU/EEA residents: all international transfers are conducted in accordance with Chapter V of the GDPR. For UAE residents: transfers comply with Articles 22–26 of Federal Decree-Law No. 45 of 2021. You may request details of the specific safeguards applied to any transfer by contacting us at the details in Section 19.

14. Children's Privacy & Child Digital Safety Law 2026

RentIncreaseUAE.com is an information and calculator platform intended exclusively for adults (18+) engaged in tenancy, rental, and property activities in the UAE. We do not knowingly collect, process, or store personal data from individuals under the age of 18.

14.1 UAE Federal Decree-Law No. 26 of 2025 — Child Digital Safety

The UAE enacted Federal Decree-Law No. 26 of 2025 on Child Digital Safety, which came into force on 1 January 2026. Full compliance is required by January 2027. This law applies to all digital platforms and ISPs operating in the UAE or directed to UAE users, including this website. Under this law:

• Digital platforms must not collect, process, or share the personal data of children under 13 without verified parental consent.
• Age-verification mechanisms proportionate to the platform's risk level are required.
• Child data must not be used for commercial profiling, targeted advertising, or any non-essential data collection purpose.
• Privacy policies must include clear disclosures about any data practices that could affect children.

14.2 Our Compliance Measures

• We apply default high-privacy settings for all users and do not engage in any data collection, profiling, or marketing directed at minors.
• Our content, calculators, and communications are designed exclusively for adult tenants, landlords, and property professionals.
• We do not operate any features, accounts, or services that would attract or be used by individuals under 18.
• Our cookie consent mechanism defaults to "declined" for all non-essential cookies, providing an additional layer of protection for any user including minors who might access the site.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete that data immediately and without exception. If you believe a child has submitted personal data to us, please contact us immediately at privacy@rentincreaseuae.com.

15. AI, Automated Decision-Making & Profiling

Under the UAE PDPL and GDPR, you have the right to know whether your personal data is used for automated decision-making or profiling that produces legal or similarly significant effects on you. We are transparent: this website does not engage in any such processing.

• No automated decisions: We make no automated decisions about any individual user that have legal or significant personal consequences. Our calculators produce results based entirely on publicly available RERA rent index data and the inputs you provide — they generate an informational output, not a binding decision.
• No individual profiling: We do not build personal profiles of individual users. Analytics data is aggregate and anonymised and cannot be used to identify or target any specific person.
• No AI-driven data use: We do not currently use AI, machine learning, or large language models to process, classify, or make decisions based on your personal data.

As required by the UAE PDPL and its 2026 enforcement guidance, Data Protection Impact Assessments (DPIAs) are required before implementing any high-risk processing — including AI or automated profiling tools. Should we ever introduce such features, a DPIA will be conducted and this policy will be updated to reflect the new processing activities and applicable user rights, including the right to request human review of any automated decision.

16. Data Protection Officer (DPO)

Under the UAE PDPL 2026 guidance, a formal Data Protection Officer (DPO) appointment is mandatory for controllers engaged in large-scale processing of sensitive personal data or systematic monitoring. As an informational website that collects only minimal, non-sensitive data primarily for operational purposes, we do not currently meet the threshold requiring mandatory DPO appointment.

However, we have designated a responsible internal Privacy Contact who oversees data protection compliance, responds to data subject rights requests, manages our processing register, and acts as the point of contact with the UAE Data Office or any regulatory authority.

All data protection enquiries, rights requests, and complaints should be directed to our Privacy Contact using the details in Section 19. We will reassess whether a formally appointed DPO is required as our services grow or as UAE Data Office guidance evolves.

17. Data Breach Detection & Notification

Despite our security measures, no system can be guaranteed 100% secure. We have established a documented data breach response procedure in line with the UAE PDPL (Article 17) and the 2026 UAE Cybersecurity Framework.

17.1 Our Response Procedure

• Detection and containment: Upon identifying or being notified of a suspected security incident, we will immediately investigate, contain the breach, and assess its scope and severity.
• Authority notification: Where a breach poses a risk to the rights and freedoms of individuals, we will notify the UAE Data Office within the timeframe required by applicable UAE law. For EU-resident users, we will notify the relevant EU supervisory authority within 72 hours as required by GDPR Article 33.
• User notification: Where a breach is assessed as posing a high risk to the rights of affected individuals, we will notify those individuals directly by email (where we hold their email address) without undue delay, providing a clear description of the breach, the data involved, likely consequences, and steps taken to address it.
• Post-incident review: Following any security incident, we conduct a root cause analysis and implement additional controls to prevent recurrence.

If you suspect a security vulnerability or data incident related to this website, please report it to us immediately at privacy@rentincreaseuae.com. We take all such reports seriously and will respond within 24 hours.

18. Changes to This Privacy Policy

We review this Privacy Policy at least annually and update it whenever our data practices change, new legal requirements come into force, or significant developments occur in UAE or applicable international data protection law. The "Last Updated" date at the top of this page indicates when the most recent review was completed.

When we make material changes — changes that meaningfully affect how your personal data is collected, used, or shared — we will:

• Update the "Last Updated" date prominently at the top of this page.
• Display a clearly visible notice on the website homepage for a minimum of 30 days following the change, explaining what has changed and why.
• Send a direct email notification to all active newsletter subscribers describing the material change and providing a link to the updated policy.
• Where the change requires fresh consent (e.g. a new processing purpose), display a new consent prompt before that processing begins.

We encourage you to review this page periodically to stay informed of how we protect your data. Continued use of the website after the notice period for any change constitutes your acceptance of the updated policy. If you do not agree with the updated terms, please discontinue use and, where applicable, unsubscribe from any mailing list or contact us to request deletion of your data.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, how we process your personal data, or if you wish to exercise any of your rights under the UAE PDPL or GDPR, please contact us through any of the following channels:

• Privacy Contact Email: privacy@rentincreaseuae.com
• General Contact Form: RentIncreaseUAE.com/contact
• Subject Line: Please include "Privacy Request" or "Data Subject Rights Request" in the subject line of your email for faster routing to our Privacy Contact.
• Response Commitment: We will acknowledge all privacy-related requests within 5 business days and provide a full substantive response within 30 calendar days. For complex requests, we will notify you within the initial 30-day period if additional time is required (up to a maximum of 60 days in total).