Privacy Policy & Data Governance

1. What Personal Information We Collect

We collect and process personal and corporate data strictly relevant to our professional appraisal, economic research, and advisory services:

• Client Onboarding & Inquiry Data: Full name, corporate title, company entity name, official business email, telephone contact, property location details, and valuation purpose provided via our secure inquiry and survey forms (`/api/inquiry` and `/api/survey`).
• Valuation & Due Diligence Documentation: Title deeds, financial statements, lease schedules, engineering layouts, and corporate officer identities disclosed under executed Letters of Engagement (`LoE`) or Non-Disclosure Agreements (`NDA`).
• Recruitment & Valuer Application Data: CVs, Taqeem/RICS accreditation numbers, academic records, and employment history submitted to our employee and recruitment portals.
• Edge Telemetry & Security Logs: IP address hashes (`ip_hash`), active reading durations (`flushTime()`), and `Sec-Fetch-Site` request validation headers collected automatically by our edge security middleware to prevent automated bot floods and rate-limit abuse.

2. How We Use and Process Your Data

We process personal and asset data strictly for professional, contractual, and regulatory compliance objectives:

• Execution of Valuation Mandates: Preparing Taqeem, IVS 2025, and RICS-compliant appraisal reports, conducting peer reviews, and issuing independent valuation certificates.
• Compliance & Conflict Checks: Verifying client identities, checking for conflicts of interest prior to acceptance of instructions, and maintaining audit-ready engagement files.
• Client Communication & Quality Feedback: Responding to valuation inquiries, delivering requested economic research bulletins, and processing Client Satisfaction Survey ratings (`/api/survey`) to continuously elevate service standards.
• Infrastructure Hardening: Protecting edge APIs (`astunion.com`) against unauthorized cross-site request spoofing (`CSRF`) and denial-of-service attempts.

3. Legal Basis for Processing

Our data processing activities are anchored in explicit legal bases established under multi-jurisdictional frameworks:

• Saudi Personal Data Protection Law (`PDPL` - نظام حماية البيانات الشخصية): Implemented by the Saudi Data & AI Authority (`SDAIA`), our processing in KSA relies on contractual execution, adherence to mandatory Taqeem regulatory record-keeping rules, legitimate business interest in asset verification, and explicit client consent.
• UAE & DIFC Data Protection Law No. 5 of 2020: For UAE-based consultancy mandates, we process data under contractual performance, RICS compliance obligations, and legitimate supervisory interests.
• US & International Standards: Processing international client inquiries complies with applicable US federal and state data privacy statutes (`NY/CCPA`) and international fair-processing standards.

4. Data Sharing & International Transfers

Strict Ring-Fencing of Client Mandates: AssetsUnion does not sell, rent, or trade personal data, property valuation schedules, or financial records to third-party data brokers, advertisers, or external syndicates under any circumstances.

Secure Intra-Group & Regulatory Sharing: Confidential valuation data is shared on a strict need-to-know basis among our certified Taqeem fellows, RICS surveyors, and peer-review engineers across our Riyadh, Dubai, and New York offices. We transfer or disclose records externally only when explicitly authorized by the client (`e.g.`, bank panel delivery, court submission) or when legally compelled by competent judicial authorities (`SDAIA`, `TAQEEM`, `DIFC Courts`). All cross-border data transfers employ encrypted cloud channels complying with SDAIA and DIFC international transfer criteria.

5. Data Retention Protocols

Professional Appraisal Archives (`6-10 Years`): In strict accordance with the rules of conduct of the **Saudi Authority for Accredited Valuers (`TAQEEM`)**, **IVS 2025**, and **USPAP**, comprehensive work files, title records, valuation calculations, and signed appraisal certificates must be archived in encrypted digital storage for a minimum period of **six (6) to ten (10) years** from the date of issuance or final judicial resolution.

General Inquiries & Non-Engaged Records: Unconverted website contact inquiries, general feedback forms, and edge rate-limit logs are retained for up to twelve (12) months before undergoing permanent cryptographically verified deletion or anonymization.

6. Your Rights Under Privacy Regulations

Subject to applicable legal exemptions and mandatory professional retention rules (`e.g.`, Taqeem/RICS work file retention requirements), you hold clear statutory rights regarding your personal information:

• Right to Access & Information: Request confirmation of what personal details we hold and obtain a clear copy of your records.
• Right to Rectification: Request correction or updating of any inaccurate contact details or corporate designations.
• Right to Restriction & Erasure: Request the restriction of processing or permanent erasure of personal data where retention is not otherwise mandated by statutory appraisal rules.
• Right to Withdraw Consent: Withdraw previously granted consent for survey publication or promotional communications at any time.

7. Cookies, Edge Telemetry & Zero Third-Party Tracking

Zero Third-Party Ad Trackers: `astunion.com` strictly adheres to a **Zero Third-Party Dependency** commitment. We deploy zero third-party advertising cookies, zero external behavioral trackers (`Facebook Pixel`, `Google AdSense`), and zero unhosted external scripts.

First-Party Edge Analytics: To ensure optimal performance and security, our edge architecture utilizes self-contained, first-party scripts (`/assets/b.js` and `/assets/au.js`) that measure active reading duration locally (`clamped to ≤30 mins`) and transmit lightweight, anonymized edge beacons without persistent tracking cookies.

8. Data Protection Officer (`DPO`) & Supervisory Authorities

To exercise your privacy rights, lodge an inquiry regarding data governance, or request formal verification of our PDPL/DIFC compliance practices, please contact our Legal & Compliance Team:

AssetsUnion Data Governance & Compliance Desk
Email: privacy@astunion.com or valuation@astunion.com
Headquarters: King Fahd Road, Riyadh, Kingdom of Saudi Arabia
Regional Representation: Dubai International Financial Centre (`DIFC`), Dubai, UAE

You also retain the right to lodge a regulatory inquiry directly with the competent supervisory authority: the **Saudi Data & AI Authority (`SDAIA`)** within KSA, or the **Commissioner of Data Protection (`DIFC`)** within the UAE.