Privacy notice

Solvex is a record-keeping service for residential tenancies in Dubai. It is operated by [Legal entity name — to be confirmed], holding [commercial licence number and issuing authority — to be confirmed], with its registered address at [registered address — to be confirmed] ("Solvex", "we", "us").

For the purposes of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), Solvex is the controller of the personal data described in this notice, except where we say that another organisation acts as a controller in its own right.

You can contact us about anything in this notice at mvp@solvexdev.com. Our data protection contact is [name or role of the data protection officer — to be confirmed].

This notice applies to everyone whose personal data Solvex handles through its website and installable web app, including:

• tenants, landlords and agents who create or join a tenancy record;
• people who are invited to a record but have not yet accepted;
• Solvex reviewers, support and security staff, whose actions are logged;
• authorised government users who view aggregated, non-identifying statistics;
• visitors to our public pages and people who contact us through the Help page or by email.

It does not cover websites or services run by others that we link to, such as UAE PASS, banks, payment providers, the Dubai Land Department (DLD) or the Rental Dispute Centre (RDC). Their own notices apply.

Demonstration notice: during this demonstration Solvex contains only fictional people, properties and documents. Please do not enter real personal data.

In this notice:

Personal data

any information relating to an identified or identifiable natural person, as defined in the PDPL.

Processing

any operation performed on personal data, such as collecting, storing, viewing, sharing, exporting or deleting it.

Tenancy record

the shared file Solvex keeps for one tenancy, including its facts, deposit details, evidence, history and any disagreement.

Party

a tenant, landlord or agent who is a member of a tenancy record.

Evidence

a photo or document uploaded to a tenancy record, together with its caption, condition note and fingerprint.

Fingerprint

a SHA-256 value calculated from the exact bytes of an uploaded file. If even one byte changes, the fingerprint changes.

Case file

a PDF that summarises a tenancy record, with a manifest of its evidence fingerprints, which a party can download.

Reviewer

a member of Solvex staff who may open a specific record for a stated reason and for a limited time.

Processor

an organisation that processes personal data on our behalf and on our instructions.

We collect only what is needed to keep an accurate, shared tenancy record. Depending on how you use Solvex, this may include:

Identity data

your name in English and Arabic and the identifier returned when you sign in with UAE PASS. Where UAE PASS shares them, this can include your Emirates ID number, nationality and date of birth. [Exact UAE PASS attributes requested — to be confirmed]

Contact data

your email address and mobile number, and your preferred language.

Tenancy data

your role in the record, the tenancy dates, rent and payment terms, contract and Ejari references, and the facts you and the other parties confirm or correct.

Property data

the community, building, unit, property type and number of bedrooms. A property address can identify you when combined with other information.

Deposit data

the deposit amount, date paid, bank name, who holds it, its status and any receipt you upload. Solvex records these details; it never holds, moves or releases the deposit.

Evidence and its metadata

photos and documents you upload, their captions and condition notes, file name, type and size, fingerprint, the time our server received them and the capture time reported by your device. Photos can carry embedded metadata (EXIF), which may include the device model and, if your camera stores it, the location where the photo was taken. We store files unchanged so that their fingerprints stay valid; you can switch off location tagging in your camera settings before taking photos.

Inspection data

meter readings, number of keys and notes recorded at move-in and move-out.

Statements

what you write when you raise or answer a disagreement, and your responses to the other party's evidence.

Payment data

for the platform service fee: the amount, VAT, tax invoice details, payment status and reference, and the card brand and last four digits returned by our payment provider. We never receive or store your full card number or security code.

Account and security data

your sign-in sessions, the provider used to sign in, the terms version you accepted, and audit log entries of what you viewed, uploaded, exported or changed.

Device and log data

IP address, browser type, operating system, pages requested, and the date and time of each request, kept in server logs to run and protect the service.

Support data

what you tell us when you use the Help page or email us.

Preferences

your language, text size and contrast choices, stored in small cookies on your device (see section 14).

We do not ask for special categories of personal data, such as health, religion or biometric data. Please avoid including such data, or images of other people, in photos and statements.

• From you, when you sign in, create or join a record, upload evidence, write a statement or contact us.
• From other parties to your tenancy record. For example, a landlord may enter your name and contact details to invite you, or upload photos of the unit you rent.
• From UAE PASS, which confirms your identity when you sign in. In this demonstration UAE PASS is simulated.
• From connected services when they are live, such as a bank confirming a deposit, the DLD confirming an Ejari registration or the RDC confirming a case reference. In this demonstration these checks are simulated and return fictional results.
• From our payment provider, which tells us whether a fee payment succeeded, together with a masked card reference.
• Automatically, from your device and browser, when you use Solvex.

The PDPL allows processing without consent in specific cases, including where it is necessary to perform a contract with you, to comply with a legal obligation, or to establish, exercise or defend legal claims. We rely on the following:

• Creating your account and confirming your identity through UAE PASS

  Lawful basis

  Performance of our contract with you

• Keeping the tenancy record, its history and the evidence fingerprints

  Lawful basis

  Performance of our contract with you

• Inviting other parties and notifying you of changes that need your attention

  Lawful basis

  Performance of our contract with you

• Producing case files that you can share with an authority of your choice

  Lawful basis

  Performance of our contract; establishing or defending legal claims

• Charging the platform service fee and issuing tax invoices

  Lawful basis

  Performance of our contract; compliance with UAE tax law

• Keeping audit logs and investigating misuse or security incidents

  Lawful basis

  Compliance with legal obligations; protecting the service and its users

• Responding to lawful requests from courts, the RDC, the DLD or other competent authorities

  Lawful basis

  Compliance with a legal obligation

• Answering your questions and support requests

  Lawful basis

  Performance of our contract; your consent where you contact us before signing up

• Producing anonymous, aggregated statistics, such as the number of open records

  Lawful basis

  Data that has been anonymised is no longer personal data

Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before it. We will not use your data for marketing without separate consent. [Final mapping of lawful bases — to be confirmed by counsel]

Access in Solvex is denied by default. A person can open a tenancy record only if a rule allows it, and every access to a record is checked again on each request.

Parties to the record

the tenant, landlord and any agent who has accepted an invitation can see the record's facts, deposit details, evidence, history and statements.

Invited people

before accepting, an invited person sees only the summary needed to decide whether to join.

Solvex reviewers and support

staff cannot browse records. To open one they must choose a reason code (such as a dispute review, a request from a party, a correction request or a quality check), and the access expires after two hours. Every opening is recorded in the audit log.

Security administrators

a small number of staff can review the audit log and manage access, and their own actions are logged.

Government users

authorised government users can see aggregated, non-identifying statistics only. They cannot open individual records through Solvex.

Authorities you choose

if you download a case file and give it to the RDC, a court or another body, that body receives what is in the file. Solvex does not send it for you.

Authorities by legal requirement

we disclose data to a court, public prosecution, police or other competent authority only when the law requires it, and only what is required.

We do not sell, rent or trade personal data. We share it only as described in this notice and with service providers that help us run Solvex, under written contracts that require them to protect it and use it only on our instructions:

Cloud hosting and storage

Amazon Web Services (AWS) hosts the application and stores uploaded files.

Identity provider

UAE PASS, operated by the UAE government, confirms identity when you sign in. It acts as a controller of its own data under its own terms.

Payment provider

[Payment provider name — to be confirmed] processes fee payments. It receives your card details directly, and may act as an independent controller for fraud prevention and its own legal obligations. [Controller or processor status — to be confirmed]

Email and notifications

[Email delivery provider — to be confirmed] sends service emails such as invitations and reminders.

Professional advisers

lawyers, auditors and insurers, under duties of confidentiality, where needed.

If Solvex is reorganised, merged or sold, records may be transferred to the new operator, who must continue to protect them as this notice describes. We will tell you before that happens.

During this demonstration, uploaded files and the database are stored with AWS in the Asia Pacific (Mumbai) region, ap-south-1, in India. This is a transfer of data outside the UAE.

The PDPL permits transfers to countries with an adequate level of protection and, otherwise, transfers under appropriate safeguards such as contractual commitments. We rely on [transfer mechanism — to be confirmed by counsel]. Before real personal data is accepted, we will confirm the production hosting region, which may be within the UAE. [Production hosting region — to be confirmed]

Wherever data is stored, the protections in section 11 apply.

We keep data only for as long as it is needed for the purposes above or as the law requires. The periods below are being finalised:

• Tenancy records, evidence, history and statements

  How long

  For the life of the tenancy and then [retention period — to be confirmed] after the record is closed, so that it remains available if a claim is brought

• Audit log entries

  How long

  [Retention period — to be confirmed]

• Payment and tax invoice records

  How long

  As long as UAE tax law requires, currently at least five years [to be confirmed]

• Sign-in sessions

  How long

  Each session ends after twelve hours or when you sign out

• Server logs

  How long

  [Retention period — to be confirmed]

• Support messages

  How long

  [Retention period — to be confirmed]

When a retention period ends, we delete the data or anonymise it so that it can no longer identify anyone. A record that is subject to an open dispute, a legal hold or an authority's request is kept until that matter is closed.

We use technical and organisational measures appropriate to the sensitivity of tenancy records, including:

• Encryption in transit (HTTPS) and encryption at rest for stored files and the database.
• Deny-by-default access: every request to a record or file is checked against your role in that record.
• No public links to evidence. Files are served only after the same access check, never through open or shareable URLs.
• SHA-256 fingerprints for every file, shown on the record and in each case file, so anyone can confirm a file has not been altered.
• Append-only history: evidence is never overwritten, and a replacement keeps the original visible.
• An audit log that the database itself prevents from being edited or deleted.
• Time-limited, reason-coded staff access, and separation of staff roles.
• Checks on uploaded files based on their content, not their name, with a size limit. Malware scanning is simulated in this demonstration and will be replaced before launch.
• Session tokens stored only as hashes, in secure, HTTP-only cookies.

No system is completely secure. If a breach affects your personal data and is likely to put your privacy at risk, we will notify you and the UAE Data Office as the PDPL requires.

Under the PDPL you have the following rights, subject to the conditions and exceptions in the law:

Access

to know whether we process your data and to receive a copy of it. A party can already see and download the records they belong to.

Correction

to have inaccurate data corrected. In a tenancy record, facts are corrected by proposing a correction, which the other party sees; the original stays in the history so that the record remains reliable.

Erasure

to ask us to delete data we no longer need. Because evidence and statements may be needed by the other party or by an authority to resolve a claim, we may keep them until the retention period ends. We will explain any refusal.

Restriction

to ask us to limit processing while the accuracy of data, or our basis for using it, is being checked.

Objection

to object to processing based on our legitimate interests, or to any marketing.

Portability

to receive your data in a structured, commonly used format. The case file and original evidence downloads serve this purpose.

Withdrawing consent

where we rely on your consent, at any time.

To use a right, email mvp@solvexdev.com from the address on your account. We may need to confirm your identity. We will respond within [response period — to be confirmed], and within the period set by the PDPL and its executive regulations.

If you are not satisfied with our answer, you can complain to the UAE Data Office.

Solvex is intended for adults who can enter into a tenancy. You must be at least 21 years old, or otherwise have full legal capacity under UAE law, to create an account. We do not knowingly collect data from children. Please avoid photographing children or their belongings in evidence.

Solvex uses a small number of cookies and browser storage items that are needed to sign you in and to remember your language and display choices. We do not use advertising, analytics or third-party tracking cookies. The full list is in our Cookie notice.

Solvex does not make decisions about you by automated means, does not profile you, and does not use artificial intelligence, machine learning or image recognition on your records. Reminders and completeness checks are simple rules that tell parties what is missing; they never decide who is right.

We may update this notice when the service or the law changes. The version number and date at the top show when it last changed. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

For questions, requests or complaints about privacy, write to mvp@solvexdev.com or use the Help page. Postal address: [registered address — to be confirmed].