Privacy Notice

Last updated: 4 September 2026.

1. Who we are

Market-Sure is operated by PSmith Management Consulting (IFZA Free Zone, UAE). Where this notice says “we”, “us” or “Market-Sure”, that is who it means.

We are a market-information and communication-assistance service. We are not an estate agent, broker, negotiator, adviser or valuer, and nothing we produce is advice.

The main law that applies to us is the UAE Personal Data Protection Law (Federal Decree-Law 45/2021). If you are in the UK or the EU/EEA, the UK GDPR or EU GDPR may also apply to information about you, and we have written this notice to meet whichever of those standards is higher.

Questions about privacy? Email contact@market-sure.com or use the contact form. Please put “Privacy” in the subject so it reaches the right place quickly.

2. Which part of this notice applies to you

Different information is handled by different people, and it matters who decides what. There are four situations, and the rest of this notice is organised around them.

In data-protection language: for section 3 the agency is the controller and we are their processor; for sections 4 and 5 we are the controller. We are the controller for the professional register in section 6 as well.

3. If your estate agent uses Market-Sure

Estate agencies use Market-Sure to keep track of their own clients. If your agent does, your details are in their account.

Who is responsible

Your agency is. They decided to hold your details, they decided why, and they are responsible for having a proper reason to do so and for telling you about it. We hold that information on their behalf and act on their instructions — we did not choose to collect it, and we do not decide what it is used for.

That means the right first question — “why do you have my details?” — is one for your agency, not for us. We will always help them answer it, and if you come to us first we will pass your request to them and help them deal with it (see section 11).

What your agency may store

Whatever they choose to put in, which typically includes: your name; your phone number and email address; the company you work for; whether you are buying, selling, letting or renting; what you are looking for (budget, number of bedrooms, areas, size); notes your agent writes about your conversations; appointments and reminders; a record of calls, messages and meetings; properties they have matched to you; and any documents they upload.

Documents your agent uploads

Your agent can keep files against your record — a brochure, a floor plan, or something you gave them, which may include identity documents such as a passport or Emirates ID. Your agency decides what goes in; we never ask for a client’s identity documents and do not need them to run the service. We hold the file, show it back to your agency, and let them send it to you as a private link they can switch off. We do not publish it and we do not send it to an AI provider — only the title and labels your agent gives it are used to find it again. When a document is deleted, the file itself is erased and any link to it stops working.

What we do with it

We store it, show it back to your agency, and run the searches and reminders they ask for. That is all. Specifically, we do not:

• sell it, share it with other agencies, or add it to any list of our own;
• use it to market anything to you;
• use it to train or improve any AI model;
• let one agency see another agency’s clients — each agency’s records are separated in our systems.

Our legal basis

Our basis for processing it is our contract with your agency and their instructions under it. The basis for holding your details at all is your agency’s, and they are required to be able to explain it to you.

Stopping contact — the link in the message

A message an agent sends you through Market-Sure tells you how to stop it. Usually it asks you to reply STOP, and your agent takes you off their list. Some messages instead carry a personal link that looks like market-sure.com/u/… Where you get that link it is yours, it works, and it takes effect immediately — without your agent having to do anything.

Opening the link shows you a page with two choices:

• “Stop sending me messages” — that agency stops emailing and messaging you. Your phone number is not blocked, because a call about a transaction you are already in the middle of is not the same thing as a marketing message.
• “Don’t contact me at all, including by phone” — that agency stops contacting you through Market-Sure altogether.

Three things about it are worth knowing, because they are unusual:

1. It applies to that one agency, not to every agency. If two different agencies both hold your details, they are two separate records, and opting out of one changes nothing at the other. Use the link in each agency’s message. There is no single switch that covers the whole platform, and we are not going to pretend otherwise.
2. Your agent cannot undo it. Once you have used the link, only you can lift it — and only from the same browser, within an hour, if you tapped it by mistake. After that, if you change your mind, tell the agency directly.
3. The link does not identify you to anyone who sees it. It contains no name, email or phone number, and the page it opens shows none. If you forward the message, the person you forward it to learns nothing about you from it.

You can also simply tell your agency to stop contacting you — by phone, in writing, however you prefer. They can record that too, and our system respects it in the same way.

4. If you have a Market-Sure account

This section covers agents, agencies and customers who sign up with us. Here, we decide what is held and why.

What we collect

Our legal basis for each

We do not rely on “legitimate interests” to send you marketing.

The agent directory

We publish a directory of Dubai estate agents at Find a broker. Entries are built on publicly published professional registration records and extended with what the agent adds themselves.

• An entry only appears in the public directory once it has been published.
• An agent’s email and phone are shown only if that agent turns “get in touch” on. It is off unless they choose otherwise.
• A photo only appears after we have checked it, and any change sends it back for checking.
• If you are an agent and you do not want to be listed, tell us and we will remove your entry.

5. If you visit the site or send us an enquiry

The contact form and “register interest”

When you send us a message or ask to be told when something launches, we store: your email address, your name and message if you gave them, which page you were on, which feature you asked about, and your language.

We deliberately store the minimum. We do not record your IP address, a device fingerprint or any tracking identifier with your enquiry.

Our basis: your consent — you chose to send it to us. We use it to reply, and to follow up about the thing you asked about. If you would rather we deleted it, say so and we will.

Just browsing

You do not have to give us anything to read the site. Our server keeps ordinary technical logs (page, time, response) to keep the service running and secure — our legitimate interests.

Cookies

We use cookies only where they are needed to make the site work, or to remember a preference you set:

• a sign-in session cookie, and a security token that stops other websites submitting forms as you;
• a cookie that remembers how you last viewed the CRM calendar.

There are no advertising cookies, no cross-site tracking and no third-party marketing pixels on this site. Our website statistics are collected without cookies and do not identify you, which is why you are not asked to click through a cookie banner.

The site loads its typefaces from Google Fonts, and some pages load maps and charts from third-party content networks (jsDelivr, unpkg, and CARTO for map tiles). Our visitor statistics and the anti-spam check on our forms are handled by Cloudflare. Your browser fetches all of those directly, so they see your IP address and browser type. The anti-spam check passes your IP address to Cloudflare so it can tell a person from a bot — we do not store it. Beyond that we do not send any of them anything about you.

6. Where our property information comes from

The property records

Our market figures come from publicly published records of property sales and rentals in Dubai, together with public registers of buildings and projects. We organise that information into market context; we do not create it.

This is information about properties and prices, not about people. We do not publish the name of any buyer, seller, tenant or landlord from those records, and we do not attempt to work out who anyone is from them.

Figures are indicative market information. They are not a valuation, a survey, or advice.

The public register of licensed estate agents

Estate agents and agencies in Dubai have to be licensed, and the authority that licenses them publishes that register openly. We hold a copy, and unlike the property records it does contain information about people — so it is set out on its own here rather than folded into the paragraphs above.

What is in it. An agent’s name, their licence or registration number, the agency they are registered with, and whether that licence is current. The published register also carries a work email address, a mobile and telephone number and a photograph, and we keep the published record complete, so what we hold can always be checked against where it came from. Older copies we still hold also record an agent’s gender; the register no longer publishes it, so nothing newer carries it.

It is information about people at work, in a professional capacity. There is no home address in it and nothing about their clients, and we do not add anything to it. We hold the contact details in order to match an agent to their own entry and offer it back to them — not to show them to anyone else. The next paragraph says exactly what is visible.

Why we hold it. To say honestly how many licensed agents and agencies there are and how that is changing; to check that someone opening an account with us really is licensed; and to prepare the directory entry an agent can claim if they want one. Our lawful basis is our legitimate interests in running an accurate and honest market-information service, using information that has already been published about a professional role. We do not need it to be secret and we do not treat it as sensitive, but it is still information about a person and we hold it accordingly.

We do not publish the register. Without an account, two things about an agent can be seen, and it is worth being exact about both.

• A licence check. Anyone can confirm a licence by typing an agent’s exact full name or their exact licence number. It returns one agent or none — never a list, and never a search you can browse. If more than one agent shares a name it says so and names nobody. When it does answer, it shows the name, the licence number, the agency and whether the licence is current. It never shows an email, a phone number or a photograph.
• Our directory. An agent appears in our public Find a broker directory only once their entry has been published, and their email and phone are shown only if that agent turns “get in touch” on — section 4 sets that out in full.

Beyond those, we do not sell the register, we do not pass it to anyone else, and we do not send marketing to an agent because their name is in it.

How long we keep it. The two halves behave differently and it matters. The agency register is republished without the entries that have expired, so a copy taken today is the only surviving record of what it said today — that is why we take dated copies, and it is what lets a figure we published last year still be checked. The individual agent register is not republished that way: entries stay in it. We keep our dated copies of both as a historical record, not as a live list of who is trading.

If you are a licensed agent. You can ask us what we hold about you, ask us to correct it, ask us to stop using it, and ask us not to list you — section 11 says how, and we will not charge you. Two honest limits. We cannot change the published register itself, because that is the licensing authority’s record and not ours, so a correction there has to be made with them. And where a market figure we have already published was counted from a dated copy, we keep that copy so the figure stays checkable —ask us and we will tell you whether that applies to you.

7. Artificial intelligence

We use AI narrowly, and it is worth being precise about it, because the honest answer is not “we only send anonymous data”.

Most of what the platform tells you involves no AI at all. Every price, average, count and trend is produced by our own code running queries against our own database.

Where AI is used, and what it receives:

• Understanding what you asked. When you type or dictate a question or a command and our own rules cannot work out what you meant, the words you used are sent to an AI provider to be interpreted. Email addresses and phone numbers are removed before they are sent. Names, budgets and dates are not removed, because they are the meaning of the sentence — a request like “call Fatima about her 9.5M budget” cannot be understood with the name taken out. The AI is sent the sentence, the language and the time in Dubai — never your client list, never a client’s record, and never a figure from it. It returns an interpretation; our own code then runs the actual query.
• Your daily briefing. When the platform writes your morning summary, the AI is given counts and nothing else — how many viewings, callbacks and overdue tasks you have. No client name, no property, no amount.
• Writing text for you. When the platform drafts a message, the AI is given the facts by name rather than by value; the client’s name is inserted afterwards by our own code, not by the AI.
• Reading a document you upload. If you upload a professional licence card so we can verify your directory entry, or a contract for us to read, the document itself is sent to our AI provider so the details can be read off it. Those documents contain names. This does not apply to the files an agent keeps in a client’s records (section 3) — those are stored and handed back to the agency, and are never sent to an AI provider.

Controls that actually exist:

• Agents can turn AI off for their account in Settings. Ask keeps working on our own rules engine, and nothing they type is sent to an AI provider. Dictation is the exception: turning AI off does not stop a recording being sent for transcription, because that is what turns speech into words in the first place. An agent who wants nothing at all sent can type instead of dictating.
• When an agent dictates, the recording is sent to a speech-to-text provider (OpenAI, listed in section 8) to be turned into words. We keep the text, not the audio: the recording is not stored on our systems, and the provider does not use it to train their models. Typing sends no audio at all.
• We do not use your information, or your clients’ information, to train or improve any AI model, and we do not allow it to be used for any purpose other than providing the service.

8. Who else is involved

We use a small number of established companies to run the service. They act on our instructions and only for the purposes below.

We do not sell personal information, and we do not share it with anyone else except where we are required to by law.

9. Where your information is held

Our servers and database are in Frankfurt, Germany. That is where the platform’s information — including agencies’ client records — is stored.

Several of the companies in section 8 are based in, or process information in, the United States. So information can be transferred outside the UAE, and outside the UK and EU.

We are straight about what that means. The UAE is not on the UK’s or the EU’s list of countries recognised as offering equivalent protection, and neither the UK nor the EU is on any equivalent UAE list. Transfers like these need appropriate contractual protection, and each of the providers above publishes standard data-protection terms for exactly this purpose. If you want to know which protections apply to a particular provider, ask us and we will tell you.

10. How long we keep things

We would rather tell you what actually happens than quote a tidy schedule we do not follow.

Deleted automatically, on a timetable:

Deleting a report removes the property details captured for it and stops any shared link to it from working.

Kept until someone asks us to remove it:

• An agency’s client records are kept for as long as that agency keeps them. Note that “archiving” a contact inside the product hides it — it does not delete it. The agency’s account owner can erase a contact outright from that contact’s own page, and doing so permanently removes the person’s record and everything attached to it — their details and notes, their deals, tasks and diary appointments, their documents (the files themselves are destroyed and any link stops working), what they were looking for, the listings saved or sent to them, and their marketing-consent record. All that is kept is a note that a record was erased, on what date and by whom — never what it contained. The one thing erasure does not reach is the questions the agent themselves typed into Ask and the answers shown back: those are the agent’s own record, carry no link to a contact, and clear themselves as newer questions are asked. We also delete records when the agency instructs us to, and when a subscription ends we will return or delete their records on their instruction. Note that ending or cancelling a subscription does not by itself delete anything — we act on the agency’s instruction.
• Documents an agency uploads are kept for as long as that agency keeps them. Deleting a document is different from archiving a contact: the file itself is erased, and any link to it stops working. What is left is a record that the file was there and was removed — its name, type and size, who uploaded it and when — not the file. Copies inside our routine backups go when those backups age out.
• Your account details are kept while your account is open, and afterwards only for as long as we need them for tax, accounting and dispute records.
• Enquiries and support messages are kept until we have dealt with them and for a reasonable follow-up period.

We do not currently delete these on an automatic timetable — we delete them on request or on instruction. Ask us and we will do it.

11. Your rights, and how to use them

Under the UAE PDPL — and under UK/EU GDPR where it applies to you — you can ask to:

• see what is held about you, and get a copy;
• correct anything that is wrong or out of date;
• delete it, where there is no reason for it to be kept;
• restrict or object to how it is used;
• receive it in a portable form, where that right applies;
• withdraw consent at any time, where we relied on your consent;
• stop direct marketing, at any time, with no reason needed.

How to ask. Email contact@market-sure.com with “Privacy” in the subject, or use the contact form. We will not charge you, and we will reply within one month. If a request is unusually complex, or you have made several, the law allows us longer — we will tell you inside that month, and why. We may need to check who you are first, so that we do not disclose someone’s details to the wrong person; where we do, the month runs from the point we can confirm it.

One important routing point. If your details are in an agency’s client records (section 3), that agency — not us — decides the answer. Come to us and we will pass the request straight to them and give them whatever technical help they need to action it, including deleting the record. We will not make that decision for them, because it is not ours to make.

If you are not happy with how we handled it, please tell us first — most things are fixable. You can also complain to a regulator: in the UAE, the UAE Data Office; in the UK, the Information Commissioner’s Office; in the EU/EEA, your national data-protection authority.

12. How we protect it

• Traffic to and from the site is encrypted (HTTPS), and browsers are instructed to refuse an unencrypted connection to us.
• Sign-in cookies are marked secure and cannot be read by page scripts.
• Passwords are stored as salted one-way hashes. We cannot read your password, and neither can anyone who obtained the file.
• Each agency’s records are separated by the agency they belong to, so one agency’s account cannot reach another’s. Every query goes through a single shared piece of code that applies that separation before the database is asked — it is not merely hidden in the interface.
• A dictated recording goes to our speech-to-text provider to be turned into words and is not stored on our systems; we keep the text. Typing sends no audio.
• Opt-out links contain no personal details, are not indexed by search engines, and are cut out of our application records and error reports.

No system is completely secure. If something does go wrong and it affects your personal information, we will tell the people who need to know, including the relevant regulator, within the time the law requires.

13. Children

Market-Sure is a service for adults involved in property transactions. It is not intended for anyone under 18, and we do not knowingly collect information about children. If you believe we hold a child’s details, tell us and we will remove them.

14. Changes to this notice

If we change how we handle personal information, we will update this page and change the date at the top. Where a change is significant, we will tell account holders directly.

15. Contact

PSmith Management Consulting (IFZA Free Zone, UAE).
Email contact@market-sure.com (subject: Privacy) or use the contact form.

See also our Terms of Service and Disclaimer.