Privacy Policy

1. Controller

Noble Assets Properties FZ-LLC
Zone-FZ-Office G-15 RAKEZ Compass Centre
Al Shuhada' Rd, Al Jazeera Al Hamra Industrial
Ras Al Khaimah, United Arab Emirates (UAE)
E-Mail: info@napinvest.me
Phone: +971 50 880 1967

2. Scope and applicable law

This website addresses prospective clients in the United Arab Emirates as well as in Germany, Austria, Switzerland and the rest of the European Union.

As a company established in the UAE we are subject to the UAE Federal Decree-Law No. 45 of 2021 on personal data protection (PDPL). Where we process personal data of individuals in the EU, the General Data Protection Regulation applies in addition (Art. 3(2) GDPR). We consistently align our processing with the stricter of the two standards, which as a rule means the GDPR.

3. Hosting, email delivery and server log files

This website is operated on infrastructure provided by Hostinger International Ltd., Larnaca, Cyprus. The same provider also operates the outgoing mail server used for our notifications and replies. Accepting the provider terms concludes a data processing agreement including the EU standard contractual clauses.

Every page request automatically produces server log files. They record IP address, date and time, the address requested, status code, volume of data transferred, browser type and operating system, and the previously visited page. This data serves secure operation, troubleshooting and defence against attacks. It is not merged with other data sources. The legal basis is our legitimate interest in secure, uninterrupted operation (Art. 6(1)(f) GDPR). Deletion follows the retention periods of our hosting provider.

4. Cookies and consent

We use the consent management tool Borlabs Cookie (Borlabs GmbH, Hamburg, Germany). It runs on our own server and transfers no data to Borlabs. On your first visit you decide there which non-essential services may load. Until that decision, no service requiring consent is loaded.

You can change or fully withdraw your decision at any time using the consent icon at the bottom left of every page. A withdrawal takes effect for the future.

Set without consent

Set only after your consent

The legal basis for technically necessary storage is Section 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR; for all other storage it is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

5. Web analytics with Matomo

We use Matomo, an analytics tool that runs entirely on our own server. No analytics data is transferred to third parties and the data does not leave our website infrastructure.

As long as you have not agreed to the statistics category, Matomo operates without cookies. In that state it records only the page view, the shortened IP address, browser and device details and the referring page, without recognising you across visits. The legal basis is our legitimate interest in a rough measurement of reach (Art. 6(1)(f) GDPR).

If you agree to the statistics category, Matomo additionally sets the cookies listed above and can count returning visits as such. The legal basis is then your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

6. Maps

On some pages we display location maps. The map material comes from Esri (Environmental Systems Research Institute, Inc., USA) and from OpenStreetMap. The map only loads once you have released the External Media category. On loading, the respective provider receives your IP address and the map section you are viewing. The legal basis is your consent (Art. 6(1)(a) GDPR).

For the location map inside our exposé documents we additionally retrieve a static map image from Google (Google Ireland Limited). This retrieval happens from our server, so your IP address is not transmitted to Google.

7. Contact form, enquiries and exposé download

When you contact us via a form on this website, use the property finder, save a search or request an exposé, we process the details you enter there: as a rule your name, email address, telephone number, your message and search criteria such as budget, property type and region. In addition we record the property from which you started the enquiry, plus the time and language of the enquiry.

The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR); for general enquiries without contractual context, our legitimate interest in responding (Art. 6(1)(f) GDPR).

To protect against automated bulk submissions, our forms technically check whether a submission comes from a human. This evaluates an invisible additional field, the time between opening and submitting, and the number of submissions per IP address within a short period. The legal basis is our legitimate interest in preventing abusive use (Art. 6(1)(f) GDPR).

In addition we use Cloudflare Turnstile, a service of Cloudflare, Inc., USA. When you open a form, your IP address and details about your browser and device are transmitted to Cloudflare and evaluated there to determine whether the request comes from a human. Turnstile stores no cookies and no other data on your device.

This check is necessary for us to offer the form at all without losing it to automated bulk submissions. It therefore loads independently of your cookie decision, so that visitors who allow only essential services can still submit. The legal basis is our legitimate interest in preventing abusive use (Art. 6(1)(f) GDPR) in conjunction with Section 25(2)(2) TDDDG.

8. Handover to our CRM and translation

Enquiries from the contact and finder forms are handed over to our customer management system Pixxi CRM so that our advisers can work on them. The provider is established in the United Arab Emirates. Newsletter sign-ups and saved searches are not handed over to the CRM.

If your message is written in German, we have the message text machine-translated into English before handover, because our team works in English inside the CRM. For this we use DeepL (DeepL SE, Cologne, Germany). Only the message text is transmitted, not your name, email address or telephone number. The legal basis is our legitimate interest in processing your enquiry in a language our team understands (Art. 6(1)(f) GDPR).

9. Newsletter

If you sign up for our newsletter, we process the email address you provide and, where given, your name, in order to send you information about our offers. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent at any time. An informal message to info@napinvest.me is sufficient, after which we delete your address from the distribution list. Once we handle delivery through a newsletter system, every email will additionally contain an unsubscribe link.

10. Partner portal

For sales partners we operate a protected area that is not linked publicly. Sign-in works with username and password or, alternatively, via a Google account. If you use the Google sign-in, Google learns that you are signing in with us, and we receive your name, email address and profile picture from Google. This sign-in method is optional and an alternative to signing in with a password.

Inside the portal we process your access credentials, your contact and company details, and the actions you trigger there, such as documents retrieved, exposés created and contracts stored. New accounts are approved by us manually. The legal basis is the performance of the partner relationship (Art. 6(1)(b) GDPR); for the Google sign-in, your consent (Art. 6(1)(a) GDPR).

11. Recipients of your data

Beyond this we only pass on your data where you have consented, where we are legally obliged to do so, or where it is necessary to perform a contract with you. We do not sell your data.

12. Transfers to third countries

We are established in the United Arab Emirates. Your enquiries are therefore processed by us and by our CRM provider outside the EU. There is no adequacy decision by the EU Commission for the UAE. The transfer of your enquiry data is necessary so that we can provide the advice you requested (Art. 49(1)(b) GDPR).

The Esri map tiles are loaded from the USA. This happens exclusively after you have released the External Media category and is based on your explicit consent (Art. 49(1)(a) GDPR).

The spam protection of our forms runs via Cloudflare, Inc. in the USA. Cloudflare is certified under the EU-US Data Privacy Framework, for which the EU Commission has recognised an adequate level of data protection.

13. Retention periods

Independently of this we delete your data earlier as soon as you ask us to, unless a statutory retention obligation prevents it.

14. Your rights

You have the right at any time:

• to information about your stored data (Art. 15 GDPR)
• to rectification of incorrect data (Art. 16 GDPR)
• to erasure of your data (Art. 17 GDPR)
• to restriction of processing (Art. 18 GDPR)
• to data portability (Art. 20 GDPR)
• to object to processing we base on a legitimate interest (Art. 21 GDPR)
• to withdraw a consent you have given at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to info@napinvest.me is sufficient.

Independently of this you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the one at your place of residence, your place of work or the place of the alleged infringement. In the United Arab Emirates the UAE Data Office is competent.

15. Version and changes

We adapt this policy whenever the services we use or the legal requirements change. The version published here is the one that applies.

As of: August 2026