Last updated: 2 March 2026
This Privacy Policy explains how Titledeep collects, uses, shares, and protects personal data when you use our website, applications, and services.
Titledeep is a DED-licensed Dubai mainland entity. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (the UAE Federal Data Protection Law) and its implementing regulations.
Name, date of birth, nationality, residency status, contact details, and identity documents where needed for the workflow.
Income and employment/business information, supporting documents (e.g., bank statements), declared liabilities/obligations, and case attributes (intent type, property profile).
Documents you upload, extracted fields, verification outcomes, and structured evidence packs generated from those inputs.
IP address, device identifiers, security logs, and usage events to maintain security, prevent abuse, and improve reliability. Analytics data is used only where enabled and in accordance with your cookie preferences.
Messages you send to us, service communications we send you (e.g., missing items, status updates), and records of communication preferences.
Where required, we rely on lawful bases recognised under applicable UAE Federal Data Protection Law, including consent (where you explicitly authorise a specific action), contractual necessity (to deliver the service you request), legal obligations (where applicable), and legitimate interests (such as platform security and fraud prevention), balanced with your rights and expectations.
Where we use consent, we present clear consent prompts and maintain records of consent events and changes over time.
Credit bureau reports and formal AML/KYC decisions are typically performed by authorised financial institutions or regulated entities. Titledeep may capture and store your consent and facilitate transmission of information as part of a case workflow, but banks and authorised parties control credit decisions, bureau retrieval, and regulatory determinations.
We do not sell personal data.
If personal data is transferred outside the UAE, we apply transfer safeguards consistent with UAE Federal Data Protection Law requirements. This may include transfers to jurisdictions with adequate data protection levels as determined by the UAE Data Protection Office, contractual protections where required, and vendor due diligence and security controls.
We retain case records and documents for as long as needed to provide the service, meet legitimate operational and auditability needs, and handle disputes, security investigations, and complaints. When retention is no longer required, we delete or anonymise personal data where appropriate, subject to legal holds and applicable law.
Where applicable, you may have rights including access, correction, deletion, restriction, objection, and portability, subject to conditions and exceptions. We may need to verify your identity before responding.
How to submit a request: email privacy@titledeep.com or use the in-service privacy request workflow (recommended).
Response: we respond within timelines required by applicable law and guidance.
If you disagree with our response: you may have the right to lodge a complaint with the UAE Data Protection Office where UAE Federal Data Protection Law applies.
For high-risk processing activities, Titledeep assesses privacy risk and may conduct Data Protection Impact Assessments (DPIAs) where appropriate. Titledeep maintains privacy governance processes, including vendor due diligence and controls for sensitive data handling.
We apply technical and organisational measures designed to protect personal data, including encryption, access controls, and security logging. See the Security & Trust Center for a high-level overview.
We assess and respond to personal data breaches in line with applicable obligations. Where a breach is likely to result in serious harm, notification to relevant authorities and affected individuals may be required without undue delay, consistent with UAE Federal Data Protection Law requirements and regulatory guidance.
We may update this policy from time to time. If changes are material, we will provide notice through the service or by email before the update takes effect.