Data Handling & RERA Stance

Effective 30 July 2026

Our position

  • Nelkins Technologies FZ-LLC operates Broker OS, a software platform for licensed brokers and brokerages. Nelkins Properties is the related real-estate agency brand and the public domain used for the service.
  • The software does not independently advise on, negotiate or execute a property transaction. Regulated brokerage activity remains the responsibility of the licensed brokerage and authorised broker using it.
  • We do not sell your data, your contacts' data or information about your transactions.
  • We do not share data with other tenants. Each brokerage and agent operates in a scoped workspace.
  • We are not affiliated with, endorsed by or operating on behalf of RERA, the DLD, Bayut, Property Finder, Dubizzle or any other named third party.

How broker data is scoped

Database queries are scoped to the signed-in user and workspace. Cross- tenant reads are blocked at the application layer and protected by database controls where deployed. A broker in one workspace cannot see another workspace's contacts, listings, deals, messages or mailbox data.

Sensitive PII and connected accounts

Contact phone numbers and email addresses are stored encrypted at rest and indexed using a blind index for matching. Connected-mailbox OAuth tokens are encrypted, access is recorded in audit activity, and permissions are limited to the functions disclosed before connection.

Deletion requests

Anyone whose details appear in a broker's contact list may request deletion by emailing privacy@nelkins-os.xyz. We process verified deletion requests within 30 days, subject to records that must be retained by law.

  • We verify the identity and authority of the requester.
  • Where relevant, we notify the responsible brokerage of a lawful retention obligation.
  • We remove personal data after verification unless a legal retention ground applies.

WhatsApp and email consent

Brokers are responsible for having an appropriate lawful basis before adding a contact and sending marketing or automated communications. WhatsApp sends must follow Meta's opt-in and template policies. Email outreach must comply with applicable UAE data-protection and anti-spam law. Connecting a personal mailbox does not override contact-level consent, suppression, quiet-hour or recent-contact safeguards.

Audit trail

Significant actions, including sends, mailbox authorisation, exports, role changes and deletion operations, are recorded in an activity log scoped to the relevant workspace.

Reporting concerns

Security or privacy concerns: security@nelkins-os.xyz