Privacy Policy

1. Who we are

This website (gccmortgages.com) is operated by GCC Mortgages — a mortgage brokerage licensed and regulated in the United Arab Emirates.

• Trading name: GCC Mortgages
• DED Trade Licence Number: 1215743
• RERA Registration Number: 57888
• Registered address: Dubai Hills Estate, Dubai, United Arab Emirates
• Contact email: admin@gccmortgages.com
• Contact telephone: +971 58 598 6155

For the purposes of applicable data protection laws — including the UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL"), and the EU General Data Protection Regulation ("GDPR") and UK GDPR insofar as they apply to visitors from those regions — GCC Mortgages is the data controller of your personal data.

2. What personal data we collect

We collect only the data necessary to provide our services and respond to your enquiries. Depending on how you interact with us, this may include:

Information you provide directly

• Contact details: full name, contact number, email address
• Property enquiry details: residency status, employment status, monthly income (as provided), existing monthly liabilities, property status, purchase price band, deposit available, purchase type, timeline, and any additional notes you supply
• Mortgage application data (if we progress your enquiry to a formal application with a lender): identity documents, salary and employment evidence, bank statements, credit reference reports, and any documents you supply to support your application
• Communications: messages, calls and WhatsApp exchanges initiated by or with you

Information collected automatically

• Device and browser information: IP address, browser type and version, operating system, referring website, pages visited, timestamps
• Cookies and similar technologies: see our separate Cookie Policy for details

3. Why we use your personal data

We use your personal data for the following purposes:

• To respond to your enquiry and provide a mortgage assessment tailored to your circumstances
• To identify and match you to the most suitable lenders across our panel of 25+ UAE banks and international lenders
• To submit your application to the lender(s) you authorise us to approach on your behalf
• To communicate with you about your enquiry, application, and related follow-up
• To comply with our legal, regulatory and licence obligations under UAE Central Bank, RERA, DED and any other applicable requirements — including anti-money laundering (AML) and know-your-customer (KYC) checks
• To protect the security and integrity of our website, systems and services
• To improve our services and website through aggregated, non-personally-identifiable analytics

4. Legal basis for processing

We process your personal data on one or more of the following legal bases:

• Consent: where you have given us clear consent (for example, submitting an enquiry form)
• Performance of a contract: where processing is necessary for the mortgage brokerage services we provide to you
• Legal obligation: where processing is necessary for us to comply with UAE AML/KYC and regulatory obligations
• Legitimate interests: where processing is necessary for our legitimate business interests (such as fraud prevention, security, and improving our services), balanced against your rights and freedoms

5. Who we share your data with

We do not sell your personal data. We share it only where necessary to deliver our services or comply with law:

• UAE banks and international lenders — with your authorisation, we share your application details with the lenders you have selected or approved
• Regulatory authorities and courts — where required by law (e.g. AML reporting, court orders, regulatory investigations)
• Service providers acting on our behalf, under written data-processing agreements:
  • Web3Forms — our web form submission service; processes enquiry form data to deliver it to our email inbox
  • Vercel — our hosting provider; processes basic web-server logs incidental to serving the site
  • Email delivery providers — for correspondence with you (Google Workspace or equivalent)
  • Solicitors, valuers, insurance providers — introduced as part of your property transaction, with your consent

Some of these providers are based outside the UAE. Where personal data is transferred internationally, we take reasonable steps to ensure the recipient offers an adequate level of protection through contractual or technical safeguards.

6. How long we keep your data

We retain your personal data only for as long as necessary for the purposes described in this policy or as required by UAE law:

• Enquiry data that does not progress to a completed mortgage: retained for up to 24 months, then anonymised or deleted
• Application and mortgage completion data: retained for a minimum of 5 years after completion, as required by UAE Central Bank AML rules
• Marketing preferences: retained until you withdraw consent or unsubscribe
• Website analytics: aggregated and anonymised after 26 months

7. Your rights

Under the UAE PDPL and applicable data protection laws, you have the following rights over your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to correction — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your data (subject to our regulatory retention obligations)
• Right to restrict processing — ask us to limit how we use your data
• Right to object — object to processing that we rely on legitimate interests for
• Right to portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, withdraw it at any time
• Right to lodge a complaint — with the UAE Data Office or the applicable regulator in your jurisdiction

To exercise any of these rights, email us at admin@gccmortgages.com. We will respond within 30 days of receiving a verifiable request.

8. How we protect your data

We take reasonable technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse, alteration or disclosure. These include encrypted transmission (HTTPS/TLS), access controls, secure hosting, and staff training on data handling.

No system can be guaranteed 100% secure. We continually review and improve our controls.

9. Children's privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it.

10. Third-party links

Our website may link to third-party websites (banks, developers, UAE government portals, our WhatsApp Business number, etc.). This policy applies only to gccmortgages.com. We are not responsible for the privacy practices of external sites.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or industry practice. When we do, we will update the "effective date" at the top of this page. For material changes, we will take reasonable steps to notify you.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

GCC Mortgages — Data Protection Contact
Email: admin@gccmortgages.com
Phone: +971 58 598 6155
Post: Dubai Hills Estate, Dubai, United Arab Emirates

See also our Cookie Policy and Terms of Service.