Privacy Policy

This policy is issued by Qandor L.L.C-FZ (“we”, “us”, “our”), registered in the Meydan Free Zone, Dubai, U.A.E. (registered address: Business Center 1, M Floor, The Meydan Hotel, Nad Al Sheba, Dubai, U.A.E.; formation number 2307756), trading as Matt Siddell Real Estate Advisors, operator of the Investor Data Room. Where a transaction is arranged, personal data is also processed by eXp Real Estate (Br of eXp International Holdings Inc) (Dubai Branch) (trade licence 1103757, RERA registration 31998) as the licensed brokerage. You can reach us about privacy matters at matt@mattsiddell.com.

This policy applies to dataroom.mattsiddell.com, the main mattsiddell.com site, and related registration, communication, and CRM records. It explains what personal data we collect, why, who we share it with, where it is stored, and the rights you have over it.

2.1 Data you give us

1. Identity and contact details: name, email address, phone number, LinkedIn profile.
2. Account credentials: the email and system-generated password used to log in (stored as a salted hash, not in plain text, by our authentication provider).
3. Investment profile: indicative investment amount, preferred payment-plan structure, currency, company/employer and company website, and anything you tell us about yourself in the qualification form or in conversation.
4. Identity verification and source-of-funds documents, where provided as part of anti-money-laundering checks (see Section 5).
5. Communications: emails, call notes, and messages between you and Matt Siddell or his team.

2.2 Data we collect automatically

1. Technical data: IP address, browser and device type, and pages viewed, via standard web-server and hosting logs.
2. Usage data: which chapters and modules you view, downloads, and "interest flagged" actions inside the Data Room, so we know what you've engaged with.
3. Cookies and similar technologies: see our Cookie Policy for full detail on the categories used (essential, analytics, and marketing).

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”), and, where applicable to you, the EU/UK General Data Protection Regulation, we rely on the following bases:

We do not sell your personal data. We share it only as needed, with:

1. Our own team: Tamara Rhodes-Schofield (Head of Operations) and the members of my team who work with her, for account approval, administration, and follow-up.
2. eXp Real Estate (Dubai Branch) and its relevant personnel, where you proceed toward or complete a transaction through Matt Siddell as a registered broker.
3. Service providers who process data on our behalf under contract, currently: Supabase (database and account authentication), Vercel (website hosting and, where enabled, Vercel Analytics), Resend (transactional email delivery), Zapier (workflow automation connecting our platform to our CRM), Pipedrive (customer relationship management), and JotForm (an enquiry form embedded on mattsiddell.com).
4. Analytics and advertising platforms, where the relevant cookies are active: currently Google Analytics on mattsiddell.com; Meta/Instagram and LinkedIn are planned but not yet active on either site (see our Cookie Policy for the current, confirmed status).
5. Regulators, courts, or law-enforcement bodies, including under UAE anti-money-laundering reporting obligations, or professional advisers, where required or permitted by law.

As a UAE-regulated real estate brokerage activity, we and eXp Real Estate (Dubai Branch) are classified as a Designated Non-Financial Business or Profession and are subject to UAE anti-money laundering and counter-terrorist-financing law. Where you proceed toward a transaction, this may require us to verify your identity, source of funds, and beneficial ownership, screen you against sanctions and politically-exposed-person lists, and retain related records for a minimum retention period set by UAE law (currently five years from the end of the relevant business relationship or transaction).

Our technology providers may process or store your data outside the UAE: currently, our database and authentication provider (Supabase) hosts data in a data centre located in India, and our other service providers may process data in their own hosting regions (including the EU/EEA and the US). Where we transfer personal data outside the UAE, we do so on the basis permitted under PDPL, including your consent or an assessment that the recipient provides an adequate level of protection, and we require our providers to maintain appropriate security and confidentiality safeguards.

1. Account and Data Room engagement data: for as long as your account is active, and for a reasonable period after if you become inactive, so we can re-engage you or respond to queries.
2. Qualification, transaction, and AML/KYC records: for the minimum period required by UAE law (currently at least five years from the end of the relationship).
3. Marketing data (e.g. ad-platform interactions): until you opt out, or as limited by the relevant platform's own retention rules.
4. If your application is declined, we retain a minimal record of that outcome for our own audit trail, and delete the rest of your qualification data within a reasonable period unless law requires otherwise.

Subject to applicable law, you can ask us to:

1. Access the personal data we hold about you, and get a copy of it;
2. Correct inaccurate or incomplete data;
3. Restrict or object to certain processing, or ask us to stop processing your data for marketing;
4. Delete your data, subject to our legal retention obligations described in Section 7;
5. Where the EU/UK GDPR applies to you, receive your data in a portable format, and lodge a complaint with your local supervisory authority.
6. Where the California Consumer Privacy Act applies to you, know what categories of data we've collected and shared, and opt out of any sale or sharing of your data (we do not sell personal data).

To exercise any of these rights, email matt@mattsiddell.com. We'll respond within the timeframe required by applicable law (generally 30 days under PDPL and UK/EU GDPR, or as otherwise required).

We use industry-standard technical and organisational measures to protect your data, including encrypted connections, hashed passwords, and access controls limiting Data Room content to approved investors only (enforced at the database level). No system is completely secure, and we cannot guarantee absolute security of information transmitted to us.

The Data Room is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect personal data from minors.

Details of the cookies and similar technologies used on this site are set out in our separate Cookie Policy.

We may update this policy as our practices, providers, or the law change. We'll post the updated version here with a new effective date, and notify active investors of material changes by email.

For any privacy question or to exercise your rights, email matt@mattsiddell.com.

Matt Siddell Real Estate Advisors — Investor Data Room