Privacy notice

This explains what happens to personal data on elhaam-mirzapour-s.com. It is written to be read, not skimmed past. Two things are worth knowing before you go any further:

• The home page loads Instagram's own embed code automatically. Meta sees your IP address and the fact that you were on this page, whether or not you look at the posts.
• An enquiry form is live: a short version on the home page and a fuller one on the contact page. Both collect your name, email, phone number, budget and timeline; the contact page also asks your purpose, property type, bedrooms, area and financing, and also asks you to agree that your details may be stored in Europe, which is required — the database is hosted there, so the transfer happens the moment a record is written, and the form will not send without it. A separate box for marketing updates is genuinely optional: leave it unticked and you still get a reply. Every submission records which exact version of the consent wording you saw, published in full below.

The law this notice is built on is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL), in force since 2 January 2022. It applies to personal data of people living or working in the UAE, wherever the controller sits. If you are in the EU or EEA, see the last section as well.

Under the PDPL the "controller" is the person who decides why and how your data is used. A privacy notice has to name that person, give an address, and give a way to contact them.

That information is not yet published on this site. It has to be filled in before the notice is complete:

Until those are published: the site publishes a name — in the footer copyright and in the page metadata — and a WhatsApp number. It does not publish a legal or trading identity, a postal address, or an email address, and a name on its own neither identifies a controller nor gives you a route to exercise a right. The contact channels this site publishes are the enquiry form and the WhatsApp number, both on the contact page. The Instagram handle appears on the home page and in the footer.

Every visit. When you open any page, Cloudflare — the company that serves this site — handles your connection. That means it processes your IP address, your browser's user agent string, the time of the request and the page requested. This is how the page reaches you and how bad traffic is kept out. There is no way to visit a website without this happening.

The home page, automatically. The Instagram section loads a script from Instagram (Meta). See the next section but one.

When you send an enquiry. There is a short form on the home page and a fuller one on the contact page. What you type is sent out of your browser only when you press the button, and it is then stored. Every field a stored record holds is listed under "Enquiry data" below.

That is the whole list. To be specific about what is not here: no Google Analytics, no Google Tag Manager, no Plausible, no Facebook pixel, no chat widget, no advertising tags. The site itself sets no cookies for analytics or advertising, though Cloudflare's network may set short-lived security cookies of its own — see the Cookie Notice for detail. There is no login and no visitor account. No payments are taken. Fonts are served from this site's own domain, so no request goes to Google Fonts when you load a page.

• Delivering and securing the site. Connection data is processed because a page cannot be served without it, and because a site with no abuse protection does not stay up. This is necessary for the service you asked for by opening the page.
• Answering your enquiry. The data you type into the form is processed to reply to you and to work out whether the thing you are asking about is worth doing. The basis is your consent, given when you submit, and the necessity of processing it to do the work you asked for.
• Sending you a guide you asked for. No guides are published today. If gated guides ship, an email address given to request one will be used to send it, on the basis of consent, and for nothing else.
• Follow-up messages about property. The form on the contact page carries a separate, unticked box for marketing follow-up. Those messages go only to people who tick that box, and consent can be withdrawn at any time. The short form on the home page does not offer the box at all, so sending it can never opt you in.
• Keeping records. Proof of what you consented to, and when, is kept because the PDPL requires a controller to be able to prove consent.

There is an enquiry form on this site: a short one on the home page, a fuller one on the contact page. Sending either one is the only thing on these pages that puts your name, email or phone number into a database, and it happens only when you press the button. The two calculators are not that — they are forms, but they compute in your browser and send nothing anywhere, so working through one leaves no record. Apart from an enquiry you choose to send, the only data leaving your browser is the connection metadata Cloudflare needs to serve the page and, on the home page, the request the Instagram embed makes to Meta.

Submitting the form sends your details to a Cloudflare Worker at api.elhaam-mirzapour-s.com, which stores one row in a Cloudflare D1 database named "elham". That row holds:

• a record ID and the date and time it was created,
• which page the enquiry came from — the home page or the contact page,
• your name,
• your email address,
• your phone number in international format,
• your country code,
• the budget band, timeline and purpose you select,
• the property type and the number of bedrooms you select, the area or tower you name, and whether you say you are buying with cash or a mortgage — the contact page asks these four, the home page does not,
• your message,
• an internal status and internal notes about the conversation, visible only to the operator,
• the date and time you gave consent, and a version marker for the exact consent wording you saw,
• the date and time you ticked the marketing box and a version marker for that wording, if you ticked it — left empty if you did not, and an empty one is read as a refusal, not as a gap to be filled in later,
• the date and time you agreed to your details being stored in Europe, with a version marker for the wording you saw — always present, because the form cannot be sent without that agreement,
• the country your IP address resolved to (the country only, not the address itself),
• your browser's user agent string,
• and whether the anti-spam check passed.

If gated PDF guides ship, requesting one would follow the same enquiry path described here — a row in this database — while the file itself would be served from the Cloudflare R2 bucket described in the previous section, not from this database.

Two supporting pieces of processing come with that. Turnstile runs on the form — on both of them — to tell people from bots; it looks at browser and connection signals to do so, and a submission that does not pass is refused before anything is written down. A rate limiter counts requests by IP address and route in a short fixed window — five submissions per ten minutes — to stop the form being hammered; those counts are short-lived and are not part of your enquiry record.

Your data leaves the UAE. The D1 database was created in Cloudflare's EEUR (Europe) region. So enquiry data is stored in Europe, not the UAE. Under the PDPL that is a cross-border transfer and it has to be justified before it happens, which is why it is stated here rather than buried.

The route relied on is your explicit consent. Above the submit button, before you send anything, the form states that your details will be processed and stored on servers in Europe, and you have to tick to agree before it will send. If you do not agree, do not use the form — use WhatsApp instead, and no database row is created. A separate, unticked box lower down the form covers marketing follow-up only; leaving it unticked does not stop your enquiry from being answered. Cloudflare's data processing addendum, under which Cloudflare states it applies standard contractual clauses, would sit underneath that as a second layer of protection once the addendum has been accepted on the account holding this data — see the operator input above — but consent is the route being relied on regardless.

• Cloudflare connection logs: held by Cloudflare on its own schedule. Not controlled from here.

• Consent records: kept for as long as the enquiry record they belong to, plus a reasonable period afterwards, because they are the proof that consent was given.

You can ask for your record to be deleted before any of these periods run out. See "Your rights".

• Cloudflare, Inc. — hosting, content delivery, the database, file storage, bot protection and rate limiting. A processor for this site's data.
• Meta — through the Instagram embed on the home page, as described above. This one happens in your browser, directly, and is not something this site can filter.

Beyond that, data is shared only where the law requires it — a court order, a regulator's lawful request, or a legal claim.

Under the PDPL you have the right to:

• Access your data, and be told how and why it is being processed, who it has been shared with, and where it has been transferred.
• Portability — receive the data you provided in a structured, commonly used, machine-readable format.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted.
• Restriction — have processing paused, for example while a dispute about accuracy is sorted out.
• Object to processing.
• Object to processing for direct marketing. You do not have to give a reason, and marketing messages stop.

On marketing specifically: the TDRA's rules on unsolicited electronic communications apply, and Cabinet Decision No. 56 of 2024 requires consent before telemarketing through social media. So no marketing message will be sent, by email, SMS, WhatsApp or Instagram, unless you have agreed to it, and every one will carry a way to stop it.

Send the request to the contact address named in "Who is responsible for your data" once a privacy contact email is published. Until then, use the WhatsApp number on the contact page.

Say what you want (a copy, a correction, deletion, or a stop on marketing). You will get an answer as quickly as possible, and the operator's own target is 30 days from receipt. That is a commitment made here, not a period fixed by a published regulation — the PDPL's Executive Regulations have not been issued. There is no charge. If your data cannot be found — likely, if you have only ever messaged on WhatsApp — you will be told that plainly rather than left waiting.

The PDPL requires consent to be clear, simple, unambiguous and easy to give, and it requires the controller to be able to prove it was given.

Every submission will store the moment consent was given and a version marker for the wording shown on screen at that moment. For that marker to mean anything, each version of the wording must be kept in a register the operator maintains.

That register is below. Each entry is reproduced from the same code that renders the form, not retyped, so the wording on screen, the wording recorded against your enquiry, and the wording published here are guaranteed to be the same sentence. A later correction becomes a new version rather than an edit to this one, so nothing already shown is rewritten after the fact.

• processing-v1, effective 27 August 2026, required to submit the form: "I agree that Elham Mirzaapour may store the details I have entered here and use them to respond to my enquiry."
• marketing-v1, effective 27 August 2026, optional — leaving it unticked still gets you a reply: "You may also send me occasional updates about Dubai off-plan launches and market commentary. I can withdraw this at any time."
• transfer-v1, effective 27 August 2026, required — the form will not send without it, because the database region makes the transfer unavoidable: "I understand that my details will be stored on Cloudflare infrastructure in Europe, outside the UAE, and I agree to that transfer."

To withdraw consent, say so on the contact channel above. It takes effect straight away. Withdrawing does not make the processing that happened before it unlawful, and it does not delete your record by itself — if you want the record gone as well, ask for erasure at the same time.

If personal data held for this site is exposed, lost, or accessed by someone who should not have it, and that creates a risk to your privacy or the security of your data, the competent UAE data protection authority will be notified on becoming aware of it, and so will you, with what happened, what data was involved and what to do about it.

One caveat, stated because it is true rather than hidden: as of the date at the top of this page the PDPL's Executive Regulations have not been published and the UAE Data Office is not yet established. Where no authority is operational to receive a notification, the obligation to tell you directly is the one that is met, and the authority is notified as soon as there is one to notify.

The GDPR applies to you independently, on its own targeting test. Complying with UAE law does not satisfy it, and this notice does not claim otherwise. Alongside the rights above, you have the GDPR rights of access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects — none are made here. You can complain to your national supervisory authority.

The ePrivacy rules also apply on top, and they require your consent before non-essential cookies are set. The Instagram embed described above sets third-party cookies before you have been asked. That is a known gap, stated here rather than glossed over, and it is the reason the guidance in that section is to block third-party cookies if you do not want Meta to see the visit.

If what happens to your data changes — a form goes live, a new tool is added, the database moves region — this notice is updated before the change takes effect, and the date at the top changes with it. Material changes will not be made quietly.