GDPR & Data Rights

The UAE’s Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data establishes controls for processing and rights for individuals within its scope. Review the UAE Government overview and the official legislation.

EU GDPR can apply to an organization outside the EU when it offers goods or services to individuals in the EU or monitors their behaviour there. The UK GDPR has a similar territorial framework. The European Union’s GDPR guidance provides a practical overview.

Zily aims to process personal data consistently with these core principles:

• lawfulness, fairness, and transparency;
• collection for specified and legitimate purposes;
• data minimization and accuracy;
• retention only for as long as necessary;
• security appropriate to the risk; and
• accountability for providers and processing decisions.

The Privacy Policy describes actual categories, purposes, recipients, and retention criteria.

• Contract: creating and securing your account, providing requested workspace features, synchronizing membership access, and responding to support.
• Legal obligation: tax, accounting, consumer-protection, sanctions, regulator, and valid legal-process requirements.
• Legitimate interests: preventing fraud, maintaining security and service reliability, measuring essential operations, enforcing terms, and defending claims while balancing those interests against your rights.
• Consent: optional marketing or non-essential tracking if introduced and where consent is required. Consent can be withdrawn without affecting earlier lawful processing.

• Information and access: learn whether data is processed and obtain a copy.
• Correction: fix inaccurate or incomplete information.
• Deletion: request erasure where data is no longer needed or processing is unlawful, subject to legal exceptions.
• Restriction: limit processing in defined circumstances.
• Portability: receive eligible data you supplied in a commonly used, machine-readable format.
• Objection: object to direct marketing and, in certain cases, processing based on legitimate interests.
• Withdraw consent: stop future consent-based processing.
• Complaint: contact the competent data-protection or supervisory authority.

Rights are not absolute. For example, deletion may not cover a record that must be retained for tax, fraud prevention, billing disputes, or legal claims. The European Commission publishes an official summary of GDPR rights.

1. Email [email protected] from the address associated with your Zily account.
2. State the right you want to exercise and the scope of the request. Never send a password, API secret, or full payment-card number.
3. We may ask for proportionate information to verify identity and protect the account from an unauthorized request.
4. We will acknowledge and respond within the time required by applicable law. Under GDPR, the ordinary response period is one month, subject to permitted extensions for complex or multiple requests.
5. If we cannot fulfil all or part of the request, we will explain the lawful reason and available complaint route.

Requests are generally free. A reasonable fee or refusal may apply only where the applicable law permits it, such as for manifestly unfounded or excessive repeat requests.

Authentication, billing, email, hosting, security, and support providers may process data outside your country. Where GDPR transfer restrictions apply, Zily relies on a valid mechanism such as an adequacy decision, standard contractual clauses, or another permitted safeguard and considers supplementary controls appropriate to the transfer risk.

Zily algorithms score and compare properties. They do not make a solely automated decision about you that produces legal or similarly significant effects. Zily does not decide whether you receive a mortgage, may purchase property, qualify as an investor, or should complete a transaction.

Contact [email protected] first so we can investigate. You may also contact the UAE Data Office or another competent UAE authority where available. If GDPR applies, you may contact the supervisory authority in the EU/EEA country of your habitual residence, place of work, or alleged infringement. UK users may contact the UK Information Commissioner’s Office.