Privacy policy

1. Who we are

The Works CRM is run by The Works Group, Dubai Silicon Oasis, trade licence no. 93788. We are the controller of the personal data described here, under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL).

This policy covers people who contact us through a Works Group website, chat, inbox or WhatsApp; the staff who use the CRM; and the owners, clients and other people whose details our staff record while handling an enquiry, a listing or a deal.

Questions and requests: [email protected].

2. What we collect

We do not knowingly collect payment card details or health data in the CRM.

• People who contact us: name, email address, phone number, your message, the site and channel it came through, the type of browser you used, and a scrambled (hashed) form of your network address, which we use to limit abuse and to spot repeat spam. A hashed address is still personal data and we treat it as such. Our staff add notes and the status of your request.
• People we message on WhatsApp: your phone number, the messages we send and receive, whether each was delivered or read, and a record of your consent (when, how, and the wording shown) and of any time you told us to stop.
• Owners, clients and deal parties: name, phone, email, notes, and the listings and deals they are attached to. Where a deal needs it, also identity and anti-money-laundering records, date of birth, nationality, address, identity-document details and expiry dates, and uploaded documents.
• Property and company records: names of owners and companies and facts about their properties and licences, taken from official Dubai property and company registers and from our own dealings. We do not show an owner's contact details to every user: they are shown only to a staff member who has been given that access, and each viewing is recorded.
• Staff: name, work email, phone and photo, role and company, login times, the network address and browser of each login, failed-login counts, and a log of actions, including any time a manager views the system as another user.

3. Why we use it, and on what ground

We use the data for these purposes and do not use it for others without a new ground (Art 5).

• To answer your enquiry and take the steps you asked for before an agreement, and to carry out an agreement with you: PDPL Art 4(9).
• To keep the records the law requires of a brokerage, including anti-money-laundering records: Art 4(10).
• To manage our staff and their access: Art 4(8) and Art 4(9).
• To make or defend a legal claim: Art 4(3).
• Personal data that you yourself have made known to everyone, such as a public business listing: Art 4(2).
• Everything else, including marketing to you and messaging you on WhatsApp, only with your consent. You can withdraw it as easily as you gave it, and withdrawing does not affect what we did before. You can also object to direct marketing at any time (Art 17).

4. Who sees it and who we share it with

Our own staff, and only inside their company and role: a staff member sees the items assigned to them, a company administrator sees their own company, and group leadership roles can see across the group. Our private office and Allure Travel are kept apart and are not reachable through this system. Actions in the CRM are logged.

We use these service providers, who handle data only for us:

Where you ask us to act for you, we also share what is needed with the other party to your transaction. We do not sell personal data.

Some replies on WhatsApp are first drafted by an automated assistant. A person reads each draft and approves it before it is sent, the assistant tells you that it is an automated assistant, and you can write HUMAN at any time to speak to a person. It answers only about our own products and services.

• Microsoft, whose email service delivers our acknowledgements and our staff notices.
• Meta (WhatsApp Business Platform; the contracting company is Meta Platforms Ireland Limited), which carries the WhatsApp messages we send and receive. We use WhatsApp's official business service only, and only for the business of The Works Group.
• Cloudflare, which serves the CRM at the edge of the network.

5. Where it is held

On a server that we run in Helsinki, within the European Union (Finland). That is outside the UAE, so the transfer is made under PDPL Arts 22 and 23, including your explicit consent where those Articles require it. Messages on WhatsApp pass through Meta, and email through Microsoft, on their own systems.

6. Your rights

Under the PDPL you can ask us, free of charge, for: what data we hold, why, who it is shared with and how long we keep it (Art 13); a copy of data you gave us in a machine-readable form, and its transfer to another controller where that is technically possible (Art 14); correction of inaccurate data and, in the cases the law lists, erasure (Art 15); restriction of processing (Art 16); to stop direct marketing and statistical use (Art 17); and to object to a decision that results from automated processing (Art 18).

Erasure has limits: we may keep records the law requires us to keep, or that we need to make or defend a claim (Art 15(3)).

To use a right, or to complain, write to [email protected]. You may also complain to the UAE Data Office, the authority that the PDPL calls the Bureau.

7. How long we keep it

We keep contact, enquiry and owner records only while they are needed for the purposes above, and we erase or anonymise a person's data when they ask under section 6 and no legal reason requires us to keep it (Art 5(7), Art 15). We do not yet delete or anonymise old CRM records automatically; until we do, a person's data stays until they ask or a staff member removes it. Anti-money-laundering and deal records are kept for the periods the law requires. If you tell us on WhatsApp to stop, we record that and send nothing further.

8. Security and breaches

Access is by personal account with a lock after repeated failed sign-ins, and each company's data is kept separate. If a breach could harm your privacy or the confidentiality of your data, we will tell the authority and you, as the PDPL requires (Art 9).

9. Changes and law

We will post any change here with a new date. This policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, and any dispute is subject to the exclusive jurisdiction of the courts of Dubai (the DIFC courts excluded).