Privacy Policy — propmates.com

Effective date:5 August 2026
Last updated:5 August 2026
Version:1.0

Table of contents

1. Who we are and what this Policy covers
2. Laws this Policy is built around
3. Definitions
4. The personal data we collect
5. How we collect it
6. Why we process it, and on what legal basis
7. Consent, and how to withdraw it
8. Who we share personal data with
9. Call recording and telephony
10. Cross-border transfers
11. How long we keep personal data
12. How we secure personal data
13. Cookies, local storage and similar technologies
14. Automated processing and profiling
15. Your rights
16. How to exercise your rights, and grievance redressal
17. Children's data
18. Personal data breaches
19. Third-party sites, listings and links
20. Marketing, DND and communication preferences
21. Changes to this Policy
22. How to contact us
23. Annexure A — Sub-processors and third-party recipients
24. Annexure B — Retention schedule

1. Who we are and what this Policy covers

This Privacy Policy ('Policy') explains how Propmates Realty & Technologies Private Limited, a company incorporated under the laws of India with CINU62099PB2026PTC067095and registered office at First Floor, Plot 75, Industrial Area Phase I, Chandigarh 160002, India, together with its UAE affiliate Propmates Prime Realty L.L.C S.O.C holding trade licence no. 1607325 issued by the Dubai Department of Economy and Tourism (DED) and registered at Exchange Tower — G06, Business Bay, Dubai, United Arab Emirates (collectively 'Propmates', 'we', 'us', 'our'), collects, uses, discloses, transfers, stores and otherwise processes personal data.

This Policy applies to:

• the websitepropmates.comand all of its subdomains;
• the Propmates mobile and web applications;
• the Propmates agent and partner consoles;
• all APIs, forms, chat, email, SMS, WhatsApp and telephone interactions operated by Propmates; and
• offline interactions arising out of the above (for example, a property site visit arranged through the platform).

Collectively, these are the 'Platform'.

Who is the data fiduciary / controller.For users located in India, Propmates Realty & Technologies Private Limited is theData Fiduciaryunder the Digital Personal Data Protection Act, 2023 ('DPDP Act'). For users located in the UAE, Propmates Prime Realty L.L.C S.O.C is theControllerunder Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ('UAE PDPL'). Where the two entities process the same data for a common purpose, they do so as joint controllers under a written arrangement, and either entity will accept and route a request from you.

Please read this Policy together with ourTerms of Use.By accessing or using the Platform you confirm that you have read this Policy. Where the law requires your consent, we ask for it separately and explicitly — continued use of the Platform is not, by itself, treated as consent for purposes that require consent.

If you do not agree with this Policy, please do not use the Platform.

2. Laws this Policy is built around

Propmates serves users inIndiaand theUnited Arab Emirates. This Policy is written to satisfy both regimes. Where the two impose different standards, we apply the standard more protective of you.

2.1 India

2.2 United Arab Emirates

2.3 Free zones and other jurisdictions

If, and only if, Propmates establishes an entity or carries out processingin or fromthe DIFC or ADGM, the DIFC DP Law 2020 or the ADGM Data Protection Regulations 2021 (as applicable) will govern that processing in place of the UAE PDPL, and we will publish a jurisdiction-specific addendum. As at 5 August 2026, no such addendum is in force.

If you access the Platform from a jurisdiction other than India or the UAE, you do so on your own initiative. We do not represent that the Platform or this Policy complies with the law of any other jurisdiction, and we do not currently target the European Economic Area, the United Kingdom or the United States.

3. Definitions

4. The personal data we collect

We collect only what the Platform actually needs to function. The categories below reflect the data the Platform genuinely stores.

4.1 Account and identity data

Collected when you register, log in, or update your profile.

• Full name
• Email address (this is your primary login identifier)
• Mobile/phone number, including country code
• Country, state, city and PIN code / postal code
• Password — storedonlyas a BCrypt one-way hash. We never store, log or transmit your password in readable form and we cannot recover it for you.
• Profile photograph, if you upload one
• Preferred locale and time zone
• Email-verification and phone-verification timestamps
• Account status (active / deactivated), account creation and update timestamps, and the identifier of the administrator who created or last updated the account where an administrator did so
• Roles and permissions assigned to your account

4.2 Authentication, session and device data

• One-time passwords (OTPs).When you log in or reset a password by OTP, we create a challenge record containing the delivery channel (email, SMS or WhatsApp), the destination address or number as it stood at that moment, the purpose (login or password reset), ahashedcopy of the code (never the code itself), the number of verification attempts and the expiry time. These records are automatically pruned once consumed or expired.
• Sessions.For each active session we hold a session identifier, theUser-Agent stringof your browser or app (which reveals your device type, operating system and browser version), theIP addressfrom which the session was created, and the session's creation and last-seen timestamps. This powers the 'signed-in devices' list and lets you revoke a session remotely.
• Access tokens.Authentication uses stateless JSON Web Tokens. The token embeds your user identifier and your permission set at the time it was issued.

4.3 Property listing data

Collected when you create or manage a Listing, whether you are an owner, a seller, or an agent acting for one.

• Listing title, description, and the property's classification (intent, category, type, subtype)
• Price, currency, and any pricing overrides or per-night rates
• Address text, city name, locality name, andprecise geographic coordinates(latitude and longitude), which we store as a geospatial point to power radius and map search
• All dynamic attributes configured for that property class — for example area, bedrooms, bathrooms, furnishing, floor, facing, amenities, possession status, RERA registration number or permit number
• Media: photographs, floor plans, videos and documents you upload, together with the file name, content type, size, and the storage key.Files are stored as you upload them.Photographs taken on a phone or camera commonly carry embedded metadata — including the GPS coordinates and timestamp of the shot and the device model — andwe do not currently strip that metadata. Remove it before uploading if you do not want it stored. In any event, assume that anything visible in a photograph you upload will be visible to viewers of the Listing.
• Featured/marketing images selected by our team for homepage placement, which are stored withpublic, permanent URLsand are therefore accessible to anyone holding the link

4.4 Listing verification data

Listings are subject to a verification workflow performed by a Propmates verification agent.

• Verification form values completed by the agent against the taxonomy-specific verification fields
• Documents uploaded in support of verification (for example ownership or authorisation documents).These may constitute sensitive personal data, and we ask you not to upload identity documents, bank details or any document containing information beyond what the verification field expressly requests.
• The identity of the assigned verification agent, submission and approval timestamps, the verification decision, and the date on which verification expires
• The full approval audit trail: who requested a status change, from what value to what value, who approved or rejected it, and when

4.5 Inquiry, lead and CRM data

Collected when you contact an owner or agent about a Listing, or when someone contacts you about yours.

• Your name, email address and phone number — either taken from your account, or, for inquiries made without signing in, from what you type into the inquiry form
• The Listing you inquired about and the message you wrote
• The pipeline, stage and stage-group your inquiry sits in, and its full stage history: every stage change, agent assignment or transfer, reopen, closure, note and field update, together with the identity of the person who made it and the timestamp
• Values captured against pipeline-specific inquiry fields — which may include budget, financing status, timeline, preferred locality, site-visit dates and documents you provide
• Internal notes written by agents about you and your requirement.These are visible to Propmates staff and to the agents handling your inquiry, and are not shown to you in the buyer view — but they are personal data about you and you may request access to them (see §15).
• The source of the inquiry (public website, signed-in user, or created by an agent on your behalf)
• A denormalised timeline snapshot of the above, built at the moment each event occurs

4.6 Telephony and call-recording data

See §9 for the consent position. Where a call is placed through the Platform's click-to-call facility:

• The phone number called, the agent's extension, our internal call identifier and the telephony provider's call identifier
• Call start and end times, duration in seconds, call status and the provider's own status codes
• Any failure reason
• A recording of the call, and the URL at which that recording is stored
• The raw payload returned by the telephony provider for that call

Note that our click-to-call provider currently acceptsIndian telephone numbers only. Calls to UAE numbers are placed outside the Platform and are not recorded by us; the recipient's own operator terms apply.

4.7 Booking data

For property classes that support stays (hotels and holiday homes):

• Check-in and check-out dates, number of units and guests
• Guest name and contact details where different from the account holder
• Total price, currency and booking status
• A booking idempotency key

We do not operate a payment gateway.We do not collect, process, transmit or store card numbers, CVVs, UPI IDs, bank account numbers or net-banking credentials. Where a payment is made in connection with a transaction originating on the Platform, it is made directly between you and the counterparty or through a third-party payment provider under that provider's own terms and privacy policy.

4.8 Agent, consultant and partner data

If you hold an agent role, or apply to become one:

• Your agent profile: service location as a geographic point, availability flag, years of experience, rating, and specialisations
• Assignment records: which Listings you were offered, which you accepted, rejected or let expire, which you are currently assigned to, and the outcome of each assignment
• Reviews and ratings submitted about you by property owners you worked with, and the aggregate rating computed from them
• Commission records: commission amounts, splits between participants, currency, payment status and payment reference strings recorded by our finance team. Payment reference strings are entered by our staff and should not contain full bank account numbers.

'Join Us' applications.If you apply to join Propmates as a consultant through the public form, we collect: full name, mobile number, email address, city, current location, preferred working areas, current consultant status, experience range, RERA licence status, educational qualification, and how you heard about us. This is a recruitment record.

4.9 Technical, log and security data

Collected automatically whenever you interact with the Platform.

• IP address and, where a trusted load balancer sits in front of our servers, the forwarded client IP address
• User-Agent string, referring URL, requested URL, HTTP method, response status and timing
• Rate-limiting counters keyed to your IP address, used to protect public endpoints from abuse
• Application and access logs
• Integration event logs.Every call the Platform makes to an external provider — and every retry, response and failure — is recorded, including the request and response payloads. Where those payloads carry your name, email address or phone number (for example, an email dispatch or a CRM sync), that personal data is present in the log.

4.10 Search and usage data

• Search terms, filters, sort orders and map viewports you use
• Location text you type into the location autocomplete field, which is forwarded to our mapping provider (see Annexure A) to return suggestions
• Listings you view, shortlist or inquire about
• Pages viewed, features used, and interaction timestamps

4.11 Content you publish

• Blog comments, reviews, testimonials and any other content you submit for publication
• Anything you publish is public.Do not put your personal contact details, financial details or identity-document numbers into free-text fields intended for publication.

4.12 Data we receive about you from others

• Where an agent creates an inquiry on your behalf after speaking to you, the agent enters your contact details
• Where a property owner lists a property and names you as a contact
• Where a co-brokerage or channel partner refers you
• Where our CRM receives a lead about you through an inbound webhook from a partner system

We require anyone who provides us with your personal data to have a lawful basis for doing so. If you believe your details were given to us without your authority, contact us atconnect@propmates.comand we will erase them, subject to §11.

4.13 What we donotcollect

For the avoidance of doubt, the Platform doesnotcollect:

• Card, UPI, net-banking or bank-account credentials (no payment gateway is integrated)
• Aadhaar numbers, PAN, Emirates ID numbers or passport numbers, unless you voluntarily upload a document containing them into a verification field — which we ask younotto do
• Biometric data
• Health data
• Data revealing your religion, caste, political opinions, trade-union membership or sexual orientation
• Continuous or background location from your device. We use the coordinates you set on a Listing or an agent profile, and any one-off location you grant to the map at the moment you grant it.

If you nonetheless upload a document containing an identity number, we will treat it as sensitive personal data, restrict access to it, and erase it on request.

5. How we collect it

6. Why we process it, and on what legal basis

Under theDPDP Act, personal data may be processed on the basis of yourconsentor forcertain legitimate usesspecified in §7 of that Act. Under theUAE PDPL, processing requires your consent unless one of the exemptions in Article 4 applies — including performance of a contract, compliance with a legal obligation, protection of vital interests, and the legitimate interests of the controller.

Purpose limitation.We do not process your personal data for a purpose materially different from those listed above without first informing you and, where required, obtaining fresh consent.

Sensitive personal data.Where processing involves sensitive personal data as defined in §3, we rely on your explicit consent, obtained separately, and we do not process it further without that consent.

7. Consent, and how to withdraw it

7.1 Notice

Where we rely on your consent, we present a notice — in English, and on request in Hindi or Arabic — that tells you, in clear and plain language: what personal data we will process, for what purpose, how you may exercise your rights, and how you may complain to the relevant regulator. This Policy is that notice in its full form.

7.2 Withdrawal

Your consent is as easy to withdraw as it was to give.You may withdraw it:

• in your account settings, for marketing and communication preferences;
• by clicking 'unsubscribe' in any marketing email;
• by replying STOP to a marketing SMS or WhatsApp message;
• by writing toconnect@propmates.com.

Withdrawal takes effect prospectively. It does not affect the lawfulness of processing carried out before withdrawal.

What withdrawal costs you.If you withdraw consent for processing that is necessary to provide a feature, that feature stops working. For example, withdrawing consent to process your phone number disables OTP login by SMS and click-to-call. If you withdraw consent for all processing, we will close your account and erase your data as described in §11. Consequences are always attributable to you and are not a penalty imposed by us.

7.3 Consent Managers (India)

Once the Government of India notifies and registers Consent Managers under §6(7) of the DPDP Act, you will be able to give, manage, review and withdraw your consent through a registered Consent Manager. We will support this facility when the framework is operational.

8. Who we share personal data with

We do not sell your personal data.We do not rent it, and we do not trade it. We share it only in the circumstances below.

8.1 Other users of the Platform — the core of the service

The Platform exists to connect people looking for property with the people offering it. That means:

• When you submit an inquiry, the Listing's owner, the agent assigned to that Listing, and Propmates staff handling the pipeline receive yourname, email address, phone number and your message. This is the entire point of the inquiry; if you do not want your contact details shared with the counterparty, do not submit an inquiry.
• When you publish a Listing, everything in the Listing — including its address, coordinates, price, attributes and media — becomes visible to Platform visitors, and, where you elect to have a contact number displayed, to anyone who views the Listing.
• When an agent is assigned to your Listing or inquiry, they receive the information they need to do the job, including your contact details and the history of the matter.
• Agent profiles, ratings and reviewsare visible to users who are matched with that agent.

8.2 Service providers (processors)

We use the third parties listed inAnnexure Ato run the Platform. Each is engaged under a written contract that requires it to process personal data only on our instructions, to apply appropriate security measures, to restrict onward transfers, and to delete or return data at the end of the engagement.

8.3 Group companies

We share personal data between Propmates Realty & Technologies Private Limited and Propmates Prime Realty L.L.C S.O.C, and with any other entity under common control, for the purposes in §6, subject to §10.

8.4 Professional advisers, auditors and insurers

Lawyers, accountants, auditors and insurers, under duties of confidentiality, where necessary.

8.5 Authorities and legal process

We disclose personal data where we are legally compelled to do so — a court order, a statutory notice, a lawful direction from a regulator, a police request made in accordance with law, or a requirement under the DPDP Act, the IT Act, the UAE PDPL, RERA, DLD, anti-money-laundering legislation or tax law. Where we are permitted to notify you of such a request, we will.

8.6 Corporate transactions

If Propmates is involved in a merger, acquisition, financing, reorganisation or sale of assets, your personal data may be transferred as part of that transaction. We will notify you and the acquirer will be bound by commitments no less protective than this Policy.

8.7 With your direction

Any other disclosure you specifically ask us to make.

9. Call recording and telephony

This section applies where a call is placed or received through the Platform's click-to-call facility.

• Calls are recorded.Where the Platform initiates a call between an agent and a user, the telephony provider records the audio and we store the recording and its metadata (§4.6).
• Why.Quality assurance, agent training, verification of what was represented to you, dispute resolution, and compliance with our record-keeping obligations.
• Notice and consent.You will be told at the start of the call, by an automated announcement, that the call is being recorded.If you do not consent to recording, disconnect and ask us to call you on an unrecorded line, or write toconnect@propmates.com.Continuing on the call after the announcement constitutes your consent to the recording for the purposes above.
• Who can hear it.The agent on the call, their supervisor, Propmates quality and compliance staff, and — where a dispute arises — our legal advisers and the relevant authority.
• How long we keep it.3months from the date of the call, unless a longer period is required for a live dispute or by law. See Annexure B.
• Your rights.You may request a copy of a recording of a call in which you participated, and you may request its erasure once any dispute and any statutory retention period has ended.
• Geography.Our click-to-call provider accepts Indian numbers only. Calls to UAE numbers are not placed through this facility and are not recorded by us.

10. Cross-border transfers

Propmates operates across India and the UAE, and some of our service providers operate globally. Your personal data may therefore be transferred to and stored in a country other than the one you are in.

10.1 Where your data sits

• The primary application, the PostgreSQL database and the Redis cache are hosted on Oracle Cloud Infrastructure in Mumbai,India.
• Uploaded files, images, videos and documents are stored in Amazon S3 in regionap-south-1(Mumbai), India.
• Transactional and marketing email is sent through Amazon Simple Email Service in regionus-east-1(N. Virginia),United States. Email delivery therefore involves a transfer of your email address, name and message content outside India and the UAE.
• Caching and session infrastructure is co-located with the application.
• The recipients in Annexure A process data in the regions stated there.

10.2 India

Section 16 of the DPDP Act permits transfer of personal data outside India except to countries that the Central Government restricts by notification.We do not transfer personal data to any country so restricted.If a country is added to the restricted list, we will relocate or cease the relevant processing. Sectoral restrictions that require certain data to be held in India — for example under RBI directions — will be complied with if and when they apply to us.

10.3 UAE

Under Articles 22 and 23 of the UAE PDPL, we transfer personal data outside the UAE only where:

• the destination has been recognised by the UAE Data Office as providing an adequate level of protection;or
• the transfer is covered by a contract or binding corporate rules containing the safeguards required by the PDPL;or
• the transfer is necessary to perform a contract with you, to establish or defend a legal claim, to protect vital interests, or is otherwise permitted by Article 23;or
• you have given your explicit consent, having been informed of the risk.

10.4 Safeguards we apply regardless of route

• Written data-processing agreements with every processor, incorporating confidentiality, security, audit, breach-notification and sub-processing controls
• Encryption of data in transit (TLS) and at rest
• Minimisation — we send a provider the least data it needs to perform its function
• Contractual restriction on the provider using your data for its own purposes

11. How long we keep personal data

We keep personal data only for as long as necessary for the purpose for which it was collected, or for as long as the law requires.Annexure Bis the full schedule. The principles:

• Active accounts.Retained while your account is open.
• Closed accounts.Retained for3years after closure, to defend legal claims, meet tax and accounting obligations, and prevent re-registration by a user we have suspended for cause. Thereafter, erased or irreversibly anonymised.
• OTP records.Automatically pruned by a scheduled job once consumed or expired.
• Uploaded files.Marked deleted and removed from object storage when you delete them, subject to backup cycles.
• Approval and audit records.Retained for the life of the account plus the statutory limitation period — these are the record of who changed what and when, and they cannot be selectively erased without destroying the integrity of the audit trail.
• Inquiry and CRM history.Retained for the life of the commercial relationship plus the limitation period.
• Call recordings.3months.
• Integration and server logs.Rotated on a rolling basis; see Annexure B.
• Anonymised and aggregated data.Data from which you can no longer be identified is not personal data and may be retained indefinitely for analytics and benchmarking.

Backups.Data erased from the live system persists in encrypted backups until those backups expire on their normal cycle. During that window the data is not available for ordinary use and is restored only in a disaster-recovery scenario, after which the erasure is re-applied.

12. How we secure personal data

We implement reasonable security practices and procedures as required by §8(5) of the DPDP Act, §43A of the IT Act read with Rule 8 of the SPDI Rules, and Article 20 of the UAE PDPL. Our controls include:

Access control

• Role-based access control with granular, named permissions; every privileged endpoint is gated on a specific permission
• Separation between a user's own-scope rights and administrative override rights
• Stateless, signed, expiring access tokens; server-side session revocation
• Passwords stored as BCrypt hashes with a per-password salt; plaintext passwords are never stored or logged
• OTPs stored as hashes, expiring, with a hard cap on verification attempts

Network and transport

• TLS for all data in transit
• Per-IP rate limiting on public endpoints, with HTTP 429 responses and back-off
• Restriction of third-party API keys by IP and by API surface

Storage

• Encryption at rest for the database and object storage
• Private files served only through short-lived pre-signed URLs; public files limited to marketing assets deliberately made public
• Secrets held outside the source repository in server-side configuration, never committed to version control

Operational

• Audit logging of authentication events, permission changes, approvals and administrative actions
• Least-privilege access for staff, granted on a need-to-know basis and reviewed periodically
• Vendor due diligence and written data-processing agreements
• Change management through peer-reviewed, version-controlled deployments
• Periodic vulnerability assessment and patching

Your part.Choose a strong, unique password. Do not share it or your OTP with anyone — Propmates staff willneverask you for your password or an OTP. Sign out of shared devices and review your active sessions periodically. Tell us immediately atconnect@propmates.comif you suspect unauthorised access.

No absolute guarantee.No method of transmission or storage is completely secure. We cannot guarantee absolute security, and to the extent permitted by law we do not warrant it. What we do guarantee is that we will apply the standard of care the law requires and will notify you of a breach as described in §18.

13. Cookies, local storage and similar technologies

13.1 What we use

We also usebrowser local storage and session storageto hold your access token, session identifier and interface preferences. These behave like cookies for privacy purposes and are covered by this section.

13.2 Your controls

• Consent banner.On your first visit we present a banner. Non-essential categories areoffuntil you enable them. You can reopen the preference centre at any time from the footer link.
• Browser controls.Every major browser lets you block or delete cookies. Blocking strictly necessary cookies will break sign-in.
• Do Not Track.We do not currently respond to browser DNT headers, because there is no agreed standard for what a compliant response looks like. Use the preference centre instead.

13.3 Third-party cookies

Advertising and retargeting cookies are set by the advertising platforms listed in Annexure A under their own privacy policies. We do not control those cookies beyond enabling or disabling the provider. We do not use a third-party analytics or error-monitoring provider: our own product analysis is performed on data already held in our own database, described in §4.

14. Automated processing and profiling

The Platform performs some processing automatically. We tell you about it here so that nothing is a surprise.

No solely automated decisions with legal effect.We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, on the basis of automated processing alone. Account suspension, listing removal and verification rejection all involve human review, and you may contest the outcome under §16.

Do not paste personal data into AI-assisted fields.If you use the content-enhancement feature, the text you supply is transmitted to a third-party AI provider. Do not include names, phone numbers, email addresses or identity numbers in a Listing title or description.

15. Your rights

Your rights come from the DPDP Act (§11–§14) if you are in India, and from the UAE PDPL (Articles 13–19) if you are in the UAE. We extend the full set to all users regardless of location.

15.1 Limits on these rights

Rights are not absolute. We may decline or limit a request where:

• we cannot verify your identity to a reasonable standard;
• the request is manifestly unfounded, excessive or repetitive;
• complying would infringe another person's rights — for example, erasing an inquiry would remove the counterparty's record of a transaction;
• the data is required for the establishment, exercise or defence of a legal claim;
• retention is mandated by law, or the data forms part of an audit trail whose integrity would be destroyed by selective erasure;
• the processing is for archival, statistical or research purposes on data that no longer identifies you.

Where we decline, we will tell you why and how to escalate.

15.2 Your duties (India)

Section 15 of the DPDP Act places duties on Data Principals. You must not: impersonate another person when providing personal data; suppress material information when providing personal data for any document, identifier or proof issued by the State; register a false or frivolous grievance or complaint; or provide false particulars when exercising your right to correction or erasure. Breaching these duties may attract a penalty under the DPDP Act.

16. How to exercise your rights, and grievance redressal

16.1 Self-service

Many things can be done directly in the Platform: update your profile, change your password, review and revoke active sessions, manage communication preferences, edit or delete your Listings, and request account closure.

16.2 Making a request

Write toconnect@propmates.comwith:

• the right you wish to exercise;
• the email address or phone number registered on your account;
• enough detail for us to locate the data (for example, the Listing ID or inquiry reference).

We will verify your identity before acting — usually by an OTP to your registered email address or phone number. We may ask for further proof where the request is high-risk.

Timelines.We acknowledge within24 hoursand respond substantively within15 days, consistent with Rule 3(2) of the IT Rules 2021. Complex requests may take up to30 days, in which case we will tell you before the first period expires. UAE requests are answered within the period required by the PDPL Executive Regulations. There is no charge for a first request; a manifestly excessive or repetitive request may attract a reasonable fee.

16.3 Grievance Officer

Grievance Officer — India(appointed under Rule 3(2) of the IT Rules 2021 and §13 of the DPDP Act):

Name: Saamarth Kaushal
Entity: Propmates Realty & Technologies Private Limited
Address: First Floor, Plot 75, Industrial Area Phase I, Chandigarh 160002, India
Email: saamarthkaushal@propmates.com
Phone: +91 90417 77898
Hours: Monday to Friday, 10:00–18:00 IST, excluding public holidays

United Arab Emirates.We have not appointed a Data Protection Officer, because we do not currently meet the thresholds in Article 10 of the UAE PDPL and its Executive Regulations. If we do meet them, we will appoint one and publish the appointment here. Until then, address UAE data protection matters toconnect@propmates.com, or by post to Propmates Prime Realty L.L.C S.O.C, Exchange Tower — G06, Business Bay, Dubai, United Arab Emirates.

You must exhaust the grievance mechanism above before approaching a regulator, unless the law provides otherwise.

16.4 Escalating to a regulator

• India— theData Protection Board of India, established under the DPDP Act. Details of its complaint procedure will be published by the Board; we will link to them here once available.
• UAE— theUAE Data Office(Federal Data Office), established under Federal Decree-Law No. 44 of 2021, at the contact channels it publishes.
• Consumer matters, India— the National Consumer Helpline (1915) or the appropriate Consumer Disputes Redressal Commission.
• Consumer matters, UAE— the Ministry of Economy Consumer Protection Department (600 522 225).
• Real-estate matters— the relevant State RERA authority in India, or the Real Estate Regulatory Agency / Dubai Land Department in the UAE.

17. Children's data

The Platform is intended for users aged18 and over. It is not directed at children and we do not knowingly collect personal data from a child.

• India.Under §9 of the DPDP Act, a 'child' is an individual under18. We do not process a child's personal data, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
• UAE.We apply the same 18-year threshold.

If you are a parent or guardian and believe a child has provided us with personal data, write toconnect@propmates.com. We will verify the report and erase the data promptly.

Persons with disability.Where a Data Principal is a person with disability who has a lawful guardian, we process their personal data only on the verifiable consent of that guardian, as required by §9(1) of the DPDP Act.

18. Personal data breaches

We maintain an incident-response process covering detection, containment, assessment, notification and remediation.

• India.In the event of a personal data breach we will notify theData Protection Board of Indiaand each affected Data Principal in the form and manner prescribed under §8(6) of the DPDP Act and the rules made under it. Notification is not conditioned on a harm threshold.
• UAE.We will notify theUAE Data Officewithout undue delay and, in any event, in accordance with Article 9 of the PDPL — as a matter of practice within72 hoursof becoming aware of a breach that would prejudice the privacy, confidentiality or security of personal data — and will notify affected data subjects where the breach poses a risk to their privacy.
• What we tell you.The nature of the breach, the categories and approximate volume of data affected, the likely consequences, the measures we have taken or propose to take, and the contact point for further information.
• CERT-In.Cyber-security incidents will additionally be reported to CERT-In within the timelines set out in its Directions of 28 April 2022 where those Directions apply.

19. Third-party sites, listings and links

• The Platform links to third-party websites, builder and developer sites, mapping services and partner portals.This Policy does not apply to them.Read their privacy policies before giving them your data.
• Listing content is provided by users.Propmates is an intermediary. We verify Listings against the process described in §4.4, but verification is not a warranty of title, legality, structural condition, approvals or the accuracy of every attribute. See theTerms of Usefor the full position.
• Where a Listing displays a builder's or developer's contact details, those details are published by the listing party, not by us.

20. Marketing, DND and communication preferences

20.1 What we send

20.2 Opting out

• Clickunsubscribein any marketing email
• ReplySTOPto a marketing SMS or WhatsApp message
• Change your preferences in your account settings
• Write toconnect@propmates.com

We action opt-outs within7 working days. Transactional messages continue regardless.

20.3 DND and regulatory registers (India)

Commercial communications sent by us are governed by the TRAI TCCCPR 2018. Registering on the National Do Not Disturb register may block promotional calls and SMS from us.However, where you have submitted an inquiry or otherwise given explicit consent, that consent may permit us or the counterparty agent to contact you notwithstanding a DND registration, for the limited purpose of responding to your inquiry. If you no longer wish to be contacted about a particular inquiry, tell the agent or write toconnect@propmates.com.

20.4 UAE

Marketing communications comply with TDRA regulations and Federal Law No. 15 of 2020. We obtain consent before sending promotional messages and honour opt-outs.

21. Changes to this Policy

We may update this Policy to reflect changes in the Platform, our practices, or the law.

• TheLast updateddate at the top always reflects the current version.
• Formaterialchanges — a new purpose, a new category of recipient, a change in retention that affects you — we will notify you by email to your registered address and/or by a prominent notice in the Platformat least 15 daysbefore the change takes effect, and, where the change requires it, seek fresh consent.
• Non-material changes take effect on publication.
• Superseded versions are archived and available on request fromconnect@propmates.com.

Continuing to use the Platform after a change takes effect signifies acceptance of the updated Policy, except where the law requires your affirmative consent — in which case we will ask for it.

22. How to contact us

Annexure A — Sub-processors and third-party recipients

This annexure lists the categories of third parties that process personal data on our behalf. We keep it current; the authoritative version is the one published at propmates.com/privacy.

We do not use a third-party product analytics or error-monitoring provider.Product analysis is performed on data already held in our own database.

Organic channels.Alongside the paid platforms above, we market the Platform through organic channels — search engine optimisation, our own email and messaging communications, our social media pages, content and referrals. These do not involve disclosing your personal data to an advertising platform.

Annexure B — Retention schedule

Periods marked with a placeholder must be set by the business and confirmed by counsel before publication. Where two periods conflict, the longer applies, and where a legal hold is in force, it overrides every period in this table.

This Policy is published in English. Translations are provided for convenience; in the event of a conflict, the English version prevails.

© Propmates Realty & Technologies Private Limited. All rights reserved.