Effective 22 October 2026
1. Who we are
This Privacy Policy is issued by Castilion Realty L.L.C., trading as Castilion Estates (“Castilion”, “we”, “us” or “our”), a limited liability company (single owner) registered in the Emirate of Dubai, holding commercial licence number 1428429 issued by the Department of Economy and Tourism, Dubai and Real Estate Regulatory Agency Office Registration Number (ORN) 46392, with its registered office at Office OF09-40, Oud Metha Tower, Umm Hurair Second, Sheikh Rashid Road, Dubai, United Arab Emirates. Castilion is the controller of the personal data described in this Policy.
This Policy applies to personal data processed through the website at castilion-estates.com/mortgages (the “Website”), including its calculators, assessment forms, plan downloads, booking tools and messaging links, and to the mortgage advisory services that follow an enquiry.
Castilion processes personal data in accordance with Federal Decree Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations, and with the other laws of the United Arab Emirates as applied in the Emirate of Dubai.
2. Personal data we collect
We collect only the personal data reasonably required for the purposes set out in section 3:
- Contact data: full name, email address, mobile number with country code, preferred contact channel and preferred contact time.
- Mortgage profile data: residency status, nationality and country of residence where provided, employment type, approximate monthly income, existing commitments, property price, deposit, loan amount, term, purchase timeline, property type and, where provided, the project and unit concerned.
- Consent records: the exact consent wording you accepted, whether you opted in to marketing, and the date and time of your consent.
- Attribution data: the page on which you arrived and campaign parameters contained in the link you followed (for example utm_source or gclid).
- Technical data: IP address, browser type, device type and pages visited, collected by our hosting provider for security and, where you consent, by our analytics tracker.
- Client documents: where you instruct Castilion, identity, residency, income, banking and property documents, which are collected securely by your adviser and never through the public forms on the Website.
We do not ask for, and you should not submit through the Website, passport numbers, Emirates ID numbers, bank account or card numbers, or passwords.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and preparing an indicative assessment | Your consent, given when you submit a form, and steps taken at your request before entering into an advisory agreement |
| Providing mortgage advisory and application support once instructed | Performance of the Castilion Mortgage Advisory Services Agreement |
| Introducing you to banks and submitting applications | Your further, specific consent, obtained before any bank receives your data |
| Identity verification, customer due diligence and record keeping | Compliance with the anti money laundering and counter terrorist financing laws of the UAE and the requirements of the Real Estate Regulatory Agency |
| Sending market updates and offers | Your separate marketing consent, which is optional and may be withdrawn at any time |
| Measuring Website use and campaign performance | Your consent through the cookie banner |
| Securing the Website and preventing misuse | Compliance with legal obligations and the protection of Castilion and its clients |
4. Data that stays on your device
The calculators keep your inputs, such as price, deposit, term and income, in the storage of your own browser so that your numbers follow you between pages. These inputs are not transmitted to Castilion unless you submit a form. You may clear them at any time by clearing your browser storage for this Website. Details are set out in the Cookie and Data Collection Notice.
5. Who receives your data
Castilion does not sell personal data. We share it only as follows:
- Banks and financial institutions operating in the UAE, only after you have given your further agreement for a specific application.
- Service providers acting on our instructions: our customer relationship management platform (HighLevel), our scheduling provider (Calendly), our secure form relay (Cloudflare), our website host, and our analytics provider where you consent. Each is bound by contractual obligations of confidentiality and security.
- WhatsApp (Meta Platforms): only when you choose to message us on WhatsApp. Messages are then governed by WhatsApp’s own terms and privacy policy.
- Authorities: regulators, courts, law enforcement and government bodies where disclosure is required by law.
6. International transfers
Some of our service providers store or process data outside the United Arab Emirates. Where personal data is transferred abroad, Castilion ensures that the transfer is permitted under UAE data protection law, either because the destination provides an adequate level of protection or because appropriate contractual safeguards are in place.
7. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that do not proceed | 24 months from the last contact, then deleted or anonymised |
| Client records and due diligence documents | The term of the engagement and five years after it ends, or longer where the law requires |
| Consent records | For as long as the related data is held, plus the applicable limitation period |
| Marketing preferences | Until you withdraw consent, after which your details are kept on a suppression list only |
| Analytics data | No longer than 26 months |
8. Your rights
Subject to the conditions of UAE data protection law, you have the right to:
- obtain information about, and a copy of, the personal data we hold about you;
- request the correction of inaccurate or incomplete data;
- request the erasure of your data where it is no longer required;
- request the restriction of processing, or object to processing, including for direct marketing;
- receive your data in a structured, commonly used format, where technically feasible;
- withdraw any consent at any time, without affecting processing already carried out; and
- lodge a complaint with the UAE Data Office.
To exercise any right, write to info@castilion-estates.com with the subject “Data request”. We shall verify your identity and respond within thirty (30) days. See also the Data Requests and AML Notice.
9. Security
Castilion applies technical and organisational measures appropriate to the risk, including encrypted transmission (HTTPS) on every page, validation and rate limiting of form submissions, restriction of access to authorised staff, and contractual controls over service providers. No transmission over the internet is completely secure, and you share data at your own risk within the limits of the law.
10. Minors
The Website and Castilion’s services are intended for persons aged eighteen (18) years or over. We do not knowingly collect personal data from minors.
11. Changes to this Policy
We may amend this Policy from time to time. The version published on the Website, with its effective date, shall prevail. This version is effective from 22 October 2026.
12. Contact
Castilion Realty L.L.C., Office OF09-40, Oud Metha Tower, Umm Hurair Second, Sheikh Rashid Road, Dubai, United Arab Emirates. Email info@castilion-estates.com. WhatsApp +971 58 670 0664.
Questions? Email info@castilion-estates.com.