Legal
How Heart of the City collects, uses, and protects the personal information of visitors and clients — written to meet GDPR, UK GDPR, and UAE PDPL standards.
Last updated · 27 September 2026 · Version 1.2
This Privacy Policy describes how Heart of the City Properties L.L.C ("Heart of the City", "we", "us", or "our") collects, uses, stores, and shares personal information about visitors to this website and individuals who contact us about Maldives real estate opportunities.
We are a limited-liability company registered with the Dubai Land Department as a licensed real estate brokerage under RERA ORN 30550. Our registered office is WeWork, The Offices 4, One Central, 8th floor, Dubai World Trade Centre, Dubai, United Arab Emirates.
For any privacy-related questions, requests, or complaints, please contact us at [email protected].
Heart of the City is established in the United Arab Emirates and our processing activities are primarily governed by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL).
Because our website is offered in multiple languages and we actively engage with clients residing in the European Union, the United Kingdom, China, the Russian Federation, and other jurisdictions, we also voluntarily align our practices with the following frameworks where they apply:
Where these frameworks grant you additional rights beyond UAE PDPL, those additional rights are honoured.
We only collect personal information that you provide to us voluntarily, together with limited technical information collected automatically for analytics and security.
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, email address, phone number or WhatsApp number | Provided by you via our enquiry form, email, WhatsApp, or by leaving your details in the on-site AI chat |
| Enquiry context | Budget range, property type of interest, preferred atolls, free-text message | Provided by you via the enquiry form |
| Technical data | IP address, browser type, device type, referring URL, pages viewed, session duration | Recorded automatically by our hosting provider (Cloudflare) for security; analytics data only if you accept cookies |
| Analytics identifiers | Cookie IDs used by Google Analytics and Microsoft Clarity | Set only if you click "Accept all" in the cookie banner |
| AI Concierge conversations | Text of messages you send to our AI assistant Shimmer, language used, and timestamp | Collected automatically when you use the on-site AI chat widget. If you leave your name or contact details in the chat and ask us to get in touch, we keep them and the related part of the conversation as an enquiry, on the same terms as a form submission |
We do not knowingly collect sensitive personal data (such as financial account numbers, government ID numbers, health data, or biometric data) through this website. Please do not submit such information via our forms — if an acquisition requires this, we will arrange a secure channel.
| Purpose | GDPR legal basis | UAE PDPL basis |
|---|---|---|
| Respond to your enquiry and advise you on Maldives real estate opportunities | Contract / pre-contractual steps (Art. 6(1)(b)) | Necessary for contract performance |
| Send occasional newsletters and market updates (opt-in) | Consent (Art. 6(1)(a)) | Consent |
| Measure website traffic and improve content (Google Analytics, Microsoft Clarity) | Consent (Art. 6(1)(a)) | Consent |
| Comply with legal, tax, anti-money-laundering, and KYC obligations | Legal obligation (Art. 6(1)(c)) | Legal obligation |
| Protect against fraud, abuse, and unauthorised access | Legitimate interests (Art. 6(1)(f)) | Legitimate interests of the controller |
| Operate and improve the AI Concierge (Shimmer) — generate relevant answers, analyse conversation quality, and enhance the service | Legitimate interests (Art. 6(1)(f)) | Legitimate interests of the controller |
On your first visit you will see a consent banner: accept all, or essential only. Without your consent the site keeps only your choice and settings (such as language) in your browser.
Only after you click "Accept all" do we load:
Before you choose, Google Analytics runs in Consent Mode and receives only cookieless signals about the visit, with no browser identifiers; Microsoft Clarity is not loaded. Cloudflare Web Analytics counts visits without cookies. Yandex Metrica and the Meta Pixel are not used on this website.
You can change your decision at any time via "Cookie settings" at the bottom of every page, or here — Cookie settings: your choice is reset, this site's analytics cookies are deleted and the banner appears again.
We do not sell or rent personal information. We share limited information only with the following categories of recipients, each bound by confidentiality and data-processing obligations:
Heart of the City is based in the UAE. Depending on the service, your personal data may be transferred to, stored in, or accessed from other countries including the United States (Cloudflare, Google, Microsoft, Anthropic, OpenAI), the United Kingdom (Attio CRM), and the Republic of Maldives (partner developers).
Where we transfer personal data outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission or other appropriate safeguards as required by GDPR Article 46. For transfers to the Maldives, where no adequacy decision currently exists, we rely on your explicit consent and on contractual confidentiality undertakings with the receiving developer.
Visitors in the Russian Federation. The UAE and the USA are not on Roskomnadzor's list of countries that provide adequate protection of personal data (Order No. 128 of 5 August 2022). By submitting an enquiry you consent to this cross-border transfer. If this matters to you, use ru.maldives.heartestate.ae, where enquiries are recorded and stored in Russia.
Subject to applicable law, you have the following rights with respect to your personal data. To exercise any right, email [email protected]. We will respond within thirty (30) days.
This website is not directed at children under the age of 18 and we do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction — TLS encryption in transit, role-based access to our CRM, and the principle of least privilege for our staff. No system is perfectly secure, so we cannot guarantee absolute security.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The "Last updated" date at the top of this page indicates when the policy was last revised.
Heart of the City Properties L.L.C
WeWork, The Offices 4, One Central, 8th floor, Dubai World Trade Centre
Dubai · United Arab Emirates
Email: [email protected]
WhatsApp: +971 56 218 8006