Privacy Policy

This Privacy Policy explains how OPENREAL TECHNOLOGIES FZCO ("OpenReal", "we", "us" or "our") collects, uses, discloses, stores and protects personal data when you use the OpenReal websites, mobile applications and Registry Mode services (together, the "Platform").

It applies to visitors, registered users, individual investors, representatives of corporate users, beneficial owners, transferors, transferees, issuer or SPV representatives, support contacts and other people whose personal data is processed through the Platform. Additional notices may apply to a specific Structure, jurisdiction, verification process or Responsible Organisation. If an additional notice conflicts with this Policy, the more specific notice applies to that processing.

OpenReal is the controller of personal data used to create and secure your OpenReal account, operate the Platform, provide support, maintain Platform security and meet OpenReal's own legal obligations.

For Structure-specific identity, eligibility, Participation Request, payment-confirmation, Registry and Controlled Transfer workflows, the relevant Responsible Organisation may also act as an independent or joint controller, because it decides why those records are required and whether a request is approved. Where OpenReal processes information strictly on that organisation's documented instructions, OpenReal acts as its processor or service provider. The Platform identifies the relevant Responsible Organisation at the point where Structure-specific data is collected.

You may send a privacy request to OpenReal even if another Responsible Organisation also controls the data. We will respond for processing we control and, where appropriate, coordinate or route the request to the responsible party.

The exact information collected depends on your role, the Structure, the permissions you grant and the checks configured by the relevant Responsible Organisation. We seek to collect only information reasonably necessary for the stated purpose.

We collect personal data:

• directly from you when you register, complete forms, upload documents, submit a request, communicate with us or use the Platform;
• from your employer, company, authorised representative, transfer counterparty or another person who is authorised to provide it;
• from Responsible Organisations, registrars, SPVs, issuers, banks, escrow providers, professional advisers and document or signature providers where authorised;
• from identity-verification and screening providers, including Sumsub, and from sanctions, PEP, fraud, corporate-registry and other lawful data sources;
• automatically from your browser, device, application, cookies, logs and security systems; and
• from competent authorities or publicly available sources where necessary and lawful for compliance, verification, fraud prevention or legal claims.

We use personal data to:

• create, authenticate, secure and administer accounts;
• provide authorised access to Structures, documents, Positions and Registry records;
• perform or support KYC, KYB, beneficial ownership, AML, sanctions, PEP, fraud and eligibility checks;
• process Participation Requests, document workflows, external payment confirmation and Controlled Transfers;
• maintain the integrity, accuracy, reconciliation and auditability of the Registry and related records;
• send security, verification, document, request, payment, transfer and Registry notifications;
• provide support, handle complaints and communicate with you;
• detect, investigate and prevent security incidents, misuse, fraud, duplicate submissions and unauthorised access;
• operate, test, troubleshoot, monitor and improve the Platform;
• comply with legal, regulatory, tax, accounting, sanctions, court, law-enforcement and recordkeeping obligations;
• establish, exercise or defend legal claims and enforce agreements; and
• send optional product or marketing communications only where permitted, with an unsubscribe or opt-out route.

Depending on the processing and the law that applies, we rely on one or more of the following grounds: your consent; steps requested before entering a contract; performance of a contract; compliance with a legal obligation; protection of rights and legal claims; substantial public-interest or compliance grounds permitted by law; and our or another party's legitimate interests where those interests are not overridden by your rights.

Legitimate interests may include securing the Platform, preventing fraud, maintaining accurate records, supporting authorised business operations, improving service reliability and defending legal rights. Where consent is the basis, you may withdraw it prospectively. Withdrawal does not affect prior lawful processing and may not require deletion of records retained under another valid legal ground.

When a verification workflow is required, the Platform connects you to Sumsub or another approved provider. The configured process may ask for identity documents, selfies, video or liveness checks, biometric information, address evidence, corporate documents and device or fraud signals. The provider compares and validates information and returns status, risk or screening results to OpenReal and the relevant Responsible Organisation.

For client-directed verification, Sumsub states that its client determines the purpose and retention settings and that Sumsub generally acts as a processor, while Sumsub may act as a controller for its own compatible purposes described in its notice. Review the provider's notice displayed before you start verification.

OpenReal does not use identity documents or biometric information for advertising. Verification and screening tools may use automated processing, but final Platform access, Participation Requests, Controlled Transfers and Registry updates remain subject to authorised rules and human approvals. Where applicable law gives you a right to request human review of a significant automated decision, contact us using the details below.

We disclose personal data only where reasonably necessary for the purposes described above, including to:

• the Responsible Organisation, SPV, issuer, manager, registrar, administrator or operator connected with the relevant Structure;
• identity-verification, KYB, AML, sanctions, PEP, fraud and screening providers, including Sumsub;
• cloud-hosting, database, secure storage, content-delivery, backup and cybersecurity providers;
• electronic-signature, document, email, SMS, push-notification, customer-support, analytics and crash-reporting providers;
• banks, escrow providers, payment counterparties and professional advisers where needed for an authorised external payment or confirmation process;
• OpenReal affiliates that provide technology, governance, security, compliance or support under appropriate access restrictions;
• auditors, insurers, accountants, lawyers and other professional advisers;
• a buyer, successor or restructuring party in a proposed or completed corporate transaction, subject to confidentiality and applicable law; and
• courts, regulators, law-enforcement bodies, sanctions authorities and other competent authorities where required or permitted by law.

We require service providers that process personal data on our behalf to use appropriate safeguards and to process it only for authorised purposes. Third parties acting as independent controllers must provide their own privacy information and are responsible for their processing.

We do not sell personal data. We do not use KYC or KYB documents, biometric information, Registry records, Positions, Participation Requests, transfer records or payment evidence for targeted advertising.

OpenReal is established in the United Arab Emirates. Personal data you provide through the Platform may be stored and processed outside the United Arab Emirates, including in Singapore, by our hosting and infrastructure providers.

Service providers process personal data in their own locations. Identity verification and screening, electronic signature, push-notification delivery, email delivery and customer-support providers may process data in the European Union, the United States, Singapore or other countries. Responsible Organisations and counterparties may also process data in their own jurisdictions. Those countries may have different privacy laws from your own.

Where required, we use an approved legal transfer mechanism, contractual safeguards, an adequacy decision, your consent or another lawful basis, and we assess the relevant security and access risks. A Structure-specific notice may identify additional locations or recipients.

We retain personal data only for as long as reasonably necessary for the purpose collected, to maintain the integrity of the Registry, to meet legal and contractual obligations, and to establish, exercise or defend claims. Retention depends on the category and context:

• Account and profile data. Kept while the account is active and for the period reasonably needed to close the account, complete deletion workflows, prevent fraud and resolve disputes.
• KYC, KYB, beneficial ownership, AML and sanctions records. Kept for the period set by applicable compliance law and the relevant Responsible Organisation. Where AML rules apply, this may commonly be at least five years after the relationship ends or an occasional transaction occurs, and may be longer in some jurisdictions.
• Registry, Position, Participation Request, Controlled Transfer and audit records. Kept for the life of the relevant Structure and any additional statutory, limitation, insolvency, tax, accounting, evidentiary or archival period. These records may need to remain even after account deletion to protect legal ownership history and the integrity of the register.
• Documents, signatures and payment evidence. Kept for the period needed to administer the relevant request or Position and for applicable legal, contractual, audit and claims periods.
• Security logs and diagnostics. Kept for a proportionate period based on security, fraud-prevention, investigation and service-reliability needs.
• Support and complaints. Kept until the matter is resolved and for a reasonable claims or regulatory period.
• Backups. Deleted or overwritten through the normal backup lifecycle, subject to security, disaster-recovery and legal-preservation controls.

When retention ends, we delete, anonymise or securely isolate personal data. We may retain de-identified information that can no longer reasonably identify you.

You may initiate deletion through Account Settings in the mobile application or submit a request at openreal.io/account-deletion. We may verify your identity before acting on the request.

Deleting an account removes your ordinary login and deletes or anonymises personal data that OpenReal is not required or permitted to retain. It does not erase valid Registry entries, executed agreements, audit trails, KYC or AML records, security evidence or other records that must remain for legal, regulatory, fraud-prevention, claims or record-integrity purposes. We will restrict retained data to those purposes and explain the relevant categories when responding to your request.

If another Responsible Organisation controls Structure-specific data, we may forward the request to it or tell you how to contact it. Account deactivation or suspension is not a substitute for a valid deletion request.

Subject to applicable law, you may have rights to:

• obtain information about processing and request access to personal data;
• correct inaccurate or incomplete data;
• request deletion where no valid retention ground applies;
• restrict or object to certain processing;
• withdraw consent for future processing where consent is the legal basis;
• receive eligible data in a portable format;
• object to or request review of certain significant automated decisions;
• opt out of optional marketing and control push notifications or non-essential cookies; and
• complain to a competent data-protection authority or court.

To exercise a right, contact info@openreal.io. Describe the request, the account email and the relevant Structure, if applicable. Do not send identity documents by ordinary email unless we provide a secure route. We may verify your identity, request clarification, apply lawful exceptions and preserve records subject to legal hold or mandatory retention.

The website may use strictly necessary cookies or similar technologies for authentication, security, session management, load balancing and preferences. Non-essential analytics or similar technologies operate only after any consent required by law, and you can change your choices through a persistent cookie-preferences control.

The mobile application may request camera, photo or file access to complete identity verification or upload authorised evidence; notification permission to send alerts; and device security functions needed for authentication. The app explains the purpose before requesting permission. You can change device permissions in your operating-system settings, although denying a permission may prevent the related feature from working.

We may use proportionate analytics and crash-reporting tools to understand reliability and security.

We use administrative, technical and organisational measures designed to protect personal data, including access controls, role-based permissions, tenant isolation, encryption in transit, encryption at rest where appropriate, secure credential storage, logging, monitoring, backup controls, vulnerability management and incident-response procedures.

No system is completely secure. You must protect your credentials, use a secure device, install updates and notify us promptly of suspected compromise. Do not send passwords, one-time codes or full identity documents through unapproved support channels.

If a personal data breach occurs, we will investigate, contain and document it and notify affected individuals and competent authorities where required by applicable law. We may need to provide practical steps to reduce risk.

The Platform is not directed to anyone under 18, and users must be adults with capacity to enter binding agreements. We do not knowingly onboard children. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action, subject to any lawful recordkeeping duty.

We may update this Privacy Policy to reflect changes in law, the Platform, our providers or processing practices. We will post the updated version with a new date. For material changes, we will provide prominent notice or request consent where required. Store disclosures and in-app notices will be updated consistently with this Policy.