This privacy policy explains how Purple Roof collects, uses, shares and protects personal data when you use purpleroof.com and the related Purple Roof websites, portals and services (together, the “Platform”). It applies to visitors, members, advertisers, agents and companies, mortgage enquirers, learners, job applicants and our suppliers and partners.
We have written it to be clear about what we do and why. We explain how we comply with the privacy laws that apply to us, including the EU and UK General Data Protection Regulation (“GDPR”), the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”) and the Sri Lanka Personal Data Protection Act No. 9 of 2022 (“Sri Lanka PDPA”). Please read it carefully.
1. Who we are
Purple Roof (“Purple Roof”, “we” or “us”) is the controller of your personal data. Where you have an agreement or order form with a Purple Roof contracting entity, that entity is the controller for that service. You can reach us at:
- Address: Office #6, 2nd Floor, M Hotel, Crystal Tower, Downtown, Dubai, United Arab Emirates
- Email: hello@purpleroof.com
- Phone: +971 600558888
Advertisers are separate controllers for some data. When you send an enquiry about a property, the advertiser (the owner, agent or company that published the ad) receives your details and becomes responsible for how they use them to respond to you. Advertisers can also connect their own Google Analytics account to their ads (see section 4.4).
2. What is personal data?
Personal data is any information that relates to an identified or identifiable person, directly or indirectly: for example your name, email address, phone number, ID number, IP address or an online identifier. Information that has been irreversibly anonymised is not personal data.
3. Legal bases and how they vary by region
We only process personal data for specific, legitimate purposes and only where a legal basis applies. In each section below we state the basis. We use these terms:
- Consent — you agree, for example through our cookie banner or an unticked checkbox. You can withdraw it at any time, and withdrawing does not affect processing carried out before.
- Contract — we need the data to provide a service you asked for or to take steps before entering into an agreement with you.
- Legal obligation — we must process the data to comply with a law (for example tax, anti-money-laundering or a lawful request from an authority).
- Legitimate interests — we have a genuine business interest (such as keeping the Platform secure) that is not outweighed by your rights. We record that balancing assessment.
GDPR / UK GDPR. Where these apply (for example, you are in the European Economic Area or the United Kingdom), we cite the relevant Article 6 ground. UAE PDPL and Sri Lanka PDPA. These laws recognise consent as the primary ground and also allow processing needed for a contract, to meet a legal obligation and certain other grounds. Where a local law does not recognise legitimate interests for a purpose, we rely on your consent or another ground that law recognises. Other countries. We apply the closest equivalent ground under local law and ask for consent where it is required.
4. Visitors to our websites
4.1 Customer service: questions, comments and complaints
Contacting us
What this involves. When you contact us by email, through the website, by phone, via live chat or on social media, we use your details to answer your question or handle your complaint.
Legal basis. Legitimate interests in responding to you (Art. 6(1)(f) GDPR); in other regions, your consent when you contact us or our need to respond to a request you made.
Personal data. Your name, contact details, the content of your message and any details you give us. For live chat, the conversation, and technical details such as your browser and approximate location.
4.2 Cookies and similar technologies
Making the Platform work, measuring it and improving it
What this involves. We use cookies, local storage and similar technologies. Some are strictly necessary; others only run if you agree through our cookie banner. See section 14 for the full list by category.
Legal basis. Strictly necessary technologies: legitimate interests / contract (a working, secure site). All others (functional, analytics, marketing): your consent (Art. 6(1)(a) GDPR and the equivalent under other laws). You can change your choice at any time through the cookie settings link in the footer.
Personal data. Browser and device type, language, pages viewed, approximate location derived from your connection, referring website, and cookie or storage identifiers.
4.3 Property searches, saved properties and favourites
Searching and saving
What this involves. You can browse and search properties without an account. If you create an account you can save properties to your favourites.
Legal basis. Contract (Art. 6(1)(b) GDPR) for saved favourites.
Personal data. Your search filters, the properties you save, and your account details.
4.4 Ad performance statistics
Showing advertisers how their ads perform
What this involves. When you view a property ad, we count visits and actions such as revealing a phone number, clicking WhatsApp, sending an enquiry, sharing or saving. We show advertisers only totals and trends for their own ads (for example daily views, where visitors came from and which countries). Advertisers cannot see who you are from these statistics. This only happens if you have accepted analytics cookies. We create a random identifier in your browser, combine it with a secret key and the date into a one-way code, and store only that code together with the ad, the type of action, the broad source (search, social, direct, other website) and your country. We do not store your name, email or IP address in these statistics, and the code changes every day, so it cannot be used to follow you across days or across ads.
Legal basis. Consent (Art. 6(1)(a) GDPR and the equivalent under other laws).
Personal data. A one-way daily code, the ad viewed, the action type, the traffic source and your country. We keep these statistics for as long as they are needed to show advertisers how their ads perform, and they are not linked to your identity.
Advertisers’ own Google Analytics (optional for advertisers)
What this involves. An advertiser may connect their own Google Analytics measurement ID to their ads. If they have, and you have accepted analytics cookies, a Google Analytics tag for that advertiser loads while you view their ad, with IP anonymisation turned on and advertising personalisation and Google signals turned off. It stops when you leave the page. Google processes this data for that advertiser, who is an independent controller of it. Purple Roof does not receive the advertiser’s Google Analytics reports.
Legal basis. Consent (Art. 6(1)(a) GDPR and the equivalent under other laws). Nothing is loaded unless you accept analytics cookies.
Personal data. Page address, the ad identifier, event type (view, contact click, enquiry, share, save), browser and device data, and the identifiers Google Analytics uses. Google may transfer this data internationally; see section 11.
4.5 Marketing and advertising technologies
Measuring and improving our advertising
What this involves. If you accept marketing cookies, we load the Meta (Facebook) Pixel, which tells Meta how you interact with our site so we can measure our advertising and show relevant adverts to people with similar interests. If you do not accept marketing cookies, the pixel does not load.
Legal basis. Consent (Art. 6(1)(a) GDPR and the equivalent under other laws).
Personal data. Pages viewed, actions taken and the cookie identifiers set by Meta. We do not upload contact lists, such as your name, email address or phone number, to advertising platforms.
5. Members (registered users)
5.1 Creating and managing your account
Your account
What this involves. To use features such as saved properties, enquiries, listing a property or applying for a mortgage, you create an account with your email address and password, or sign in with your Google account. We send you a verification email to confirm your address. We also record when you last signed in and from which IP address to protect your account.
Legal basis. Contract (Art. 6(1)(b) GDPR). Security logging: legitimate interests in protecting accounts (Art. 6(1)(f) GDPR).
Personal data. Name, email, password (stored only in hashed form), phone numbers, date of birth, nationality, gender, profile photo, biography, social-media and website links you add, your notification preferences, your Google account ID, name and email if you use Google sign-in, last sign-in time and IP address.
5.2 Sending enquiries to advertisers
Contacting an advertiser
What this involves. When you send a message or request a call about a property, we pass your enquiry to the advertiser so they can reply. You choose whether to reveal or use the advertiser’s phone number or WhatsApp. We do not share information from your browsing history or search behaviour with the advertiser. We may restrict how advertiser contact details are shown to visitors in some regions (for example Europe) to comply with local privacy laws.
Legal basis. Contract (Art. 6(1)(b) GDPR) and legitimate interests in enabling visitors to contact advertisers (Art. 6(1)(f) GDPR).
Personal data. Your name, email, phone number (if provided), the message you write, the property you asked about, date and time.
5.3 Notifications and service messages
Keeping you informed
What this involves. We send service messages about your account, enquiries, listings and applications by email and, where you have turned them on in your profile, by SMS or WhatsApp. You can change these settings in your profile or unsubscribe using the link in a message. We only send marketing messages if you have opted in, where the law requires it.
Legal basis. Contract for service messages (Art. 6(1)(b) GDPR). Marketing messages: consent (Art. 6(1)(a) GDPR) or, where the law allows, legitimate interests.
Personal data. Name, email address, phone or WhatsApp number and your notification choices.
5.4 Keeping the Platform safe
Security, fraud prevention and rule enforcement
What this involves. We keep audit records of important actions on accounts, companies and ads, screen ad text for prohibited content, and use your account ID to detect suspicious behaviour or breaches of our terms. We may tell third parties, such as the authorities, about violations where the law requires. Some screening is automated, but no decision that has legal or similarly significant effects on you is made solely by automated means: a person reviews listings and verification outcomes.
Legal basis. Legitimate interests in a safe, lawful Platform (Art. 6(1)(f) GDPR) and legal obligation (Art. 6(1)(c) GDPR).
Personal data. Account ID, actions you take on the Platform, sign-in and IP data, and the content you submit.
6. Advertisers, agents and companies
Verifying you and your company
What this involves. To publish property ads, individuals and companies may need to be verified. We collect identity and company documents, check them and keep a record of the outcome. Company accounts are managed by a company owner or administrator, who can invite agents and see company activity.
Legal basis. Contract (Art. 6(1)(b) GDPR) and legal obligation, for example anti-fraud and anti-money-laundering checks (Art. 6(1)(c) GDPR).
Personal data. Name, role, contact details, ID or passport number and document images, issuing country and expiry date, company name, registration and licence details, company documents and verification outcomes and notes.
Publishing and managing property ads
What this involves. We publish your ad on the Platform. The ad is public: it can show your property details, photos, description, price and location, and the name, photo and contact details you choose to display. Ads go through a review workflow before and after publication, and we keep a history of changes and approvals.
Legal basis. Contract (Art. 6(1)(b) GDPR).
Personal data. Everything you enter into the listing, including media, owner or agent details, payment-plan and pricing details, and the review and approval history.
Ad insights, SEO guidance and traffic statistics
What this involves. Your dashboard shows statistics for your ads (see section 4.4) and a checklist that suggests improvements to the title, description, photos and details so your ad can be found more easily in search engines. The search preview and checklist are generated from your listing content only.
Legal basis. Contract (Art. 6(1)(b) GDPR) for providing the dashboard; the statistics themselves rely on visitor consent as described in section 4.4.
Personal data. Your listing content and aggregated, non-identifying visitor statistics.
Connecting your own Google Analytics (optional)
What this involves. You may enter your Google Analytics measurement ID in your dashboard. If you do, you become responsible for your use of Google Analytics on your ads, including any notices you owe to visitors and complying with Google’s terms. We load your tag only for visitors who accepted analytics cookies and only when your account has the feature enabled. You can remove your ID at any time.
Legal basis. Contract (Art. 6(1)(b) GDPR) for providing the feature. For visitors, see section 4.4.
Personal data. Your Google Analytics measurement ID and who saved it and when.
Fees, billing and payments
What this involves. Registering is free. Paid listing and credit packages are agreed under our Terms & Conditions. For paid services we process the details needed to agree, invoice and collect fees, including payment plans and supporting evidence such as cheque copies or bank transfer references. We do not store, share, rent or lease your credit or debit card details to third parties.
Legal basis. Contract (Art. 6(1)(b) GDPR) and legal obligation for tax and accounting (Art. 6(1)(c) GDPR).
Personal data. Name, company, billing contact, tax or VAT number, invoice and payment records and bank or cheque references.
Communication and account support
What this involves. We contact you about your ads, account, verification and our services.
Legal basis. Contract and legitimate interests (Art. 6(1)(b) and (f) GDPR).
Personal data. Name, contact details, job title, company and the content of our communications.
7. Mortgage enquiries and applications
Mortgage callbacks, proposals, eligibility estimates and applications
What this involves. You can ask for a callback about mortgages by giving your name, phone or WhatsApp number, residency status and market; we use these details only to contact you about your mortgage question. You can also estimate mortgage eligibility, request a bank proposal and submit an application through the Platform. Estimates are indicative only and are not a credit decision. If you request a proposal or submit an application, we share your details and documents with the bank or lender you choose, only after you give your consent when you submit the request. Providing consent is not required to use the rest of the Platform. The lender becomes responsible for its own use of your data. Staff who process applications can see your application.
Legal basis. Your consent (Art. 6(1)(a) GDPR) to share with the lender, and contract (Art. 6(1)(b) GDPR) to handle your request. Financial data is processed with extra care.
Personal data. For a callback: name, phone or WhatsApp number (with country code), residency status and market. For proposals and applications: name, email, phone, nationality, residency status, date of birth, borrower type, monthly income and income type, loan type, finance mode, the property concerned, supporting documents and additional information you provide, and the company details if you apply on behalf of a company.
8. Learners
Courses and learning
What this involves. If you enrol in courses on the learning platform, we process your account and learning data to deliver the course and track progress.
Legal basis. Contract (Art. 6(1)(b) GDPR).
Personal data. Your account details, enrolments, lesson and chapter progress and completion records.
9. Job applicants
Recruitment and selection
What this involves. When you apply for a job through our careers site, we use your information to assess your application and contact you. We keep applications for a limited period after the vacancy closes so we can answer questions about your application, then delete or anonymise them unless you agree to a longer period. If you are hired, your data is kept under our employment retention rules.
Legal basis. Legitimate interests in running an efficient recruitment process (Art. 6(1)(f) GDPR); in other regions, your consent when you apply or steps you request before entering a contract.
Personal data. Name, contact details, date of birth, gender, marital status, nationality, address, CV and cover letter, photo, education, work history, languages, skills, social-media profiles and anything else you include.
10. Suppliers and business partners
Working with us
What this involves. We process data of our suppliers’ and partners’ staff (name, role, employer, contact details) to agree and manage orders, services and payments.
Legal basis. Contract (Art. 6(1)(b) GDPR) and legitimate interests in running our business (Art. 6(1)(f) GDPR).
Personal data. Name, job title, employer, email, phone, and invoicing and bank details of sole traders and partnerships.
11. Who we share personal data with
We do not sell your personal data. We share it only as described in this policy:
| Recipient | Why | What |
|---|---|---|
| Advertisers | To answer your enquiry (section 5.2). | Name, email, phone, message. |
| Banks and lenders | To prepare a proposal or process your application, with your consent (section 7). | Mortgage request details and documents. |
| Hosting and storage providers (for example Amazon Web Services) | To run the Platform and store files such as photos and documents. | All Platform data, under processor agreements. |
| Email and messaging providers | To send verification and service emails and messages. | Email address, name, message content. |
| Google (sign-in, Maps; Analytics where enabled) | To let you sign in with Google, show maps and, where enabled, measure usage with your consent. | Sign-in identifiers, map requests, analytics data (with consent). |
| Translation provider (GTranslate) | To translate the site into your browser language. | Page text and your language, plus your IP address as a normal part of loading the service. |
| Live-chat provider (Tawk.to) | To let you chat with us. | Chat content, browser and approximate location. |
| Meta | To measure and improve our advertising (with marketing consent). | Cookie-based identifiers and page events. |
| Professional advisers, auditors, insurers | To obtain advice, audit our accounts or manage claims. | Only what is necessary. |
| Authorities and courts | To meet legal obligations or protect rights and safety. | Only what the law requires or permits. |
| Buyers or investors of our business | In a merger, acquisition or financing, under confidentiality. | Only what is necessary. |
Service providers act on our instructions under written agreements that require them to protect your data and report any breach to us promptly. Our staff with access to personal data are bound by confidentiality. Ad content you choose to publish is public.
12. International transfers
We host our systems and store files with Amazon Web Services in India (Mumbai region). Some of our providers (for example Google, Meta and Tawk.to) are based in or access data from other countries, including the United States. Where we transfer personal data out of the EEA or the UK, we use an adequacy decision, the European Commission’s Standard Contractual Clauses (and the UK addendum or IDTA) or another safeguard allowed by law. Transfers from the UAE and Sri Lanka follow the conditions of the UAE PDPL and the Sri Lanka PDPA, such as adequacy, contractual safeguards or your consent. You can request a copy of the safeguards by contacting us.
13. How long we keep personal data
We keep personal data only as long as needed for the purposes above or as the law requires. How long depends on the purpose:
| Data | Retention |
|---|---|
| Account and profile | While your account is active. When you delete your account, we remove your personal data and keep only de-identified records that can no longer be linked to you. |
| Property ads and ad history | While the ad is live, and afterwards for as long as we need them for our records, to resolve disputes and to meet legal requirements. |
| Identity and company documents | While your account is active, and afterwards for as long as we have a legal duty to keep verification records. |
| Enquiries sent to advertisers | For as long as needed to deal with your enquiry and any follow-up or dispute, then deleted or anonymised. |
| Mortgage requests and applications | For as long as needed to handle your request, and afterwards as financial regulation or the lender requires. |
| Ad performance statistics (one-way codes) | For as long as needed to show advertisers how their ads perform. They are not linked to your identity. |
| Job applications | For a limited period after the vacancy closes, then deleted or anonymised unless you agree to a longer period. |
| Security and audit logs | For as long as needed to keep the Platform secure and investigate incidents, and longer if an investigation or legal claim requires. |
| Accounting and tax records | As long as the law requires. |
14. Cookies and similar technologies
This is our Cookie Policy, and also section 14 of our Privacy Policy.
Cookies are small files saved on your device. We also use similar technologies, such as your browser’s local storage and session storage, which work in much the same way. Some are strictly necessary for the Platform to work. All others are optional and, where the law requires it, only used with your consent.
When you first visit, our cookie banner lets you accept all, reject everything except strictly necessary technologies, or choose by category. You can change your choice at any time using the cookie settings link in the footer, or by clearing cookies and storage in your browser (some features may then stop working).
14.1 What each choice controls
- Strictly necessary — always on. Needed to sign you in, keep the Platform secure and remember your choices. These cannot be switched off here.
- Functional — the live chat (Tawk.to) and automatic page translation (GTranslate). Neither is loaded until you allow this category. If you decline, the chat bubble does not appear and the site is shown untranslated.
- Analytics — measuring how the Platform and property ads are used, including the anonymous ad statistics in section 4.4.
- Marketing — the Meta Pixel, which we use to measure and improve our advertising.
If you change your mind and withdraw consent, the chat and translation stop loading on your next page view. Cookies already saved on your device stay until they expire or you delete them in your browser. Settings you choose yourself, such as your light or dark theme or where you place the chat bubble, are saved when you make the choice.
14.2 Cookies
| Name | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
| session | Purple Roof | Keeps you signed in. | About 15 minutes, renewed while you are active | Strictly necessary |
| refresh_token | Purple Roof | Renews your sign-in without asking for your password again. | Up to 7 days, or until you sign out | Strictly necessary |
| oauth_state | Purple Roof | Protects “Sign in with Google” against forgery. | 10 minutes | Strictly necessary |
| purpleroof:consent | Purple Roof | Remembers your cookie choices on all Purple Roof websites. | 1 year | Strictly necessary |
| sidebar_state | Purple Roof (account portals) | Remembers whether the side menu is open. | 7 days | Functional |
| googtrans | GTranslate (Google Translate) | Remembers the language the site is translated into. Only set when a page is translated. | Session | Functional |
| TawkConnectionTime, twk_uuid_* | Tawk.to | Live chat: recognises you during and between chats. | Session, and about 6 months | Functional |
| _fbp, _fbc | Meta | Measures and improves our advertising. _fbc is only set if you arrive from a Facebook link. | 90 days | Marketing |
14.3 Local storage and session storage
| Name | Purpose | Duration | Category |
|---|---|---|---|
| pr_visitor_id | Random identifier used for the anonymous ad statistics in section 4.4. Created only after you accept analytics cookies. | Until you clear it | Analytics |
| purpleroof_favorites | Your saved properties before you sign in. | Until you clear it | Strictly necessary (a feature you ask for) |
| property-wizard-draft, pr_mortgage_draft, company-reg-draft, pr_pending_publish | Keeps the form you are filling in so you do not lose it. | Until you finish or clear it (company-reg-draft: session) | Strictly necessary (a feature you ask for) |
| home-auth-storage, pr_post_auth_context, postAuthIntent, rememberMe | Sign-in and registration flow: returns you to what you were doing and remembers your sign-in preference. | Session or until you clear it | Strictly necessary |
| lastPropertySearchQs | Lets you return to your search results. | Session | Strictly necessary |
| pr-theme | Your light or dark display choice. | Until you clear it | Functional |
| pr_recent_location_searches.v1, pr_geo_iso | Your recent location searches and the country we detected, to show the right market. | Until you clear it | Functional |
| pr_chat_bubble_pos | Where you moved the chat bubble. | Until you clear it | Functional |
| __GT_TRANSLATE_LANGS | GTranslate’s list of languages. | Until you clear it | Functional |
Third parties set their own cookies when their content loads and we do not control them, so please also read their policies: Google (translate.google.com and gtranslate.net), Meta and Tawk.to. Browsers let you block or delete cookies, but blocking strictly necessary ones will stop you signing in.
15. Your rights
Depending on where you live, you can:
- Be informed about how we use your data (this policy).
- Access the personal data we hold about you and get a copy.
- Correct data that is inaccurate or incomplete. You can edit most of it in your profile.
- Delete your data (the “right to be forgotten”) in the circumstances the law provides.
- Restrict our processing in certain cases.
- Port your data: receive it in a structured, machine-readable format or have it transferred.
- Object to processing based on legitimate interests or for direct marketing.
- Withdraw consent at any time, including through the cookie settings, by unsubscribing from marketing, or by contacting us.
- Not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.
- Complain to a data protection authority (see section 19).
Self-service. If you have an account, you can download a copy of your personal data or delete your account yourself at purpleroof.com/data-deletion. You can also email hello@purpleroof.com. To protect you, we may ask you to verify your identity first. We respond within one month (or the shorter period your local law requires) and tell you if we need more time or cannot fully comply, and why. We do not charge a fee unless a request is clearly unfounded or excessive.
16. How we protect your data
We protect personal data with technical and organisational measures appropriate to the risk, as required by Article 32 GDPR and similar laws. These include encrypted connections, hashed passwords, role-based access so that staff see only what their job needs, audit logging of sensitive actions, separation of environments and regular review of our security. If a personal-data breach occurs, we follow our incident process and notify the affected authorities and individuals where the law requires. Please choose a strong, unique password and tell us immediately if you think your account has been compromised.
17. Children
The Platform is not intended for anyone under 18 and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
18. Links and third-party sites
The Platform may link to other websites and social networks, for example when you share a property. Their privacy practices are their own, and this policy does not cover them.
19. Contact and complaints
Questions about this policy or your data: hello@purpleroof.com, +971 600558888, or write to us at Office #6, 2nd Floor, M Hotel, Crystal Tower, Downtown, Dubai, United Arab Emirates.
You also have the right to complain to the data protection authority where you live or work. In the United Arab Emirates this is the UAE Data Office; in Sri Lanka, the Data Protection Authority; in the EU, your national supervisory authority; in the United Kingdom, the Information Commissioner’s Office. Their contact details are on their websites.
20. Changes to this policy
We may update this policy from time to time. We post the new version here with a new “last updated” date. If a change is significant, we notify you on the Platform or by email, and where the change relies on your consent we ask for it again. Previous versions are available on request.