# GARAASSETS — GCC Data Handling Notice

**Last updated:** 2026-07-11

This document summarises how GARAASSETS handles customer data when serving users in the Gulf Cooperation Council (GCC) region — Saudi Arabia, UAE, Qatar, Kuwait, Bahrain, and Oman.

## 1. Seller identity

- **Legal name:** GARAASSETS שמאות מאוחדת גלובלית (GARAASSETS Unified Global Appraisal)
- **Registered address:** Israel
- **Governing law:** as set out in the main Terms of Service. Local mandatory data-protection laws may apply where legally required.
- **Contact:** support@garaassets.com

## 2. Data residency

- **Primary storage region:** European Union — Frankfurt, Germany.
- **Legal framework:** EU General Data Protection Regulation (GDPR 2016/679).
- **In-region hosting (Bahrain / UAE):** not currently offered. The backend provider we rely on does not yet operate a GCC data centre. If a customer requires local residency (e.g. Saudi SDAIA / NDMO compliance), we can discuss a bring-your-own-cloud arrangement.

## 3. Data collected

- Account: full name, email, phone, company.
- Case data: property addresses, land parcels, valuation figures, supporting photos and documents that the user uploads.
- Usage: page views, API calls (for security and quota).

We do NOT collect government IDs, national ID numbers, or banking details unless the user explicitly attaches them to a case.

## 4. Access controls

- Row-level security on every table — a user only sees their own cases.
- Two-factor authentication available for all accounts.
- Admin access is restricted, logged, and audited.
- All traffic is TLS 1.2+ encrypted end-to-end.

## 5. Retention and deletion

- Case data is retained for the duration of the subscription plus 7 years (matching typical expert-witness statutory retention).
- Users can request deletion at any time via the in-app privacy centre.
- Deletion is irreversible after a 30-day grace period.

## 6. Sub-processors

- **Backend / database:** Supabase (EU region).
- **AI processing:** requests may be sent to model providers (OpenAI, Google, Anthropic) — no training on customer data.
- **Payments:** Paddle (Merchant of Record for global tax handling).

## 7. Cross-border transfers

Data may transit through EU or US servers when a user uploads content. Standard Contractual Clauses (SCCs) are in place with all sub-processors.

## 8. Refund policy

30-day money-back guarantee. Refunds are processed by our Merchant of Record, Paddle. Requests may be submitted via paddle.net or by writing to **support@garaassets.com**.

## 9. Regulatory alignment

- ✅ Data-protection practices aligned with the EU GDPR (no certification is claimed)
- 🟡 ISO 27001 — we are working toward certification (Target: Q3 2027); not certified by us; our hosting provider maintains its own certification for the infrastructure layer.
- 🟡 Saudi PDPL — reviewed; local residency required for public-sector projects.
- 🟡 UAE Federal Data Protection Law (2021) — no in-region hosting required for private-sector B2B use.

## 10. Contact

For privacy or data-protection inquiries: **support@garaassets.com**

*This notice supplements the main Privacy Policy and the Terms of Service and does not replace them. Where wording differs, the main Terms govern.*