Data Processing Register
Compliance: UAE Federal Decree-Law No. 45 of 2021 (PDPL), Art. 22
Effective Date: July 2026
Controller: BuyOrSell24 (anomalyco)
Contact: support@buyorsell24.com
---
Processing Activity 1: API Account Management
| Field | Detail |
|-------|--------|
| Purpose | Create and manage user accounts for API access |
| Personal Data | Email address, name, API key (SHA-256 hash) |
| Data Subjects | API users (developers, businesses) |
| Lawful Basis | Contractual necessity (Art. 4(1)) |
| Storage Location | Germany (EU) — Hetzner Online GmbH |
| Retention | Until account deletion |
| Security | SHA-256 hashing, TLS 1.3, access controls |
| Recipients | None (data not shared) |
Processing Activity 2: API Request Logging
| Field | Detail |
|-------|--------|
| Purpose | Rate limiting, abuse detection, analytics |
| Personal Data | IP address, user agent, request timestamp, endpoint accessed |
| Data Subjects | API users |
| Lawful Basis | Legitimate interest (Art. 4(3)) — service security and integrity |
| Storage Location | Germany (EU) — Hetzner Online GmbH |
| Retention | 90 days (automatic deletion) |
| Security | Encrypted at rest, restricted database access |
| Recipients | None |
Processing Activity 3: Marketing Communications
| Field | Detail |
|-------|--------|
| Purpose | Send product updates and market insights |
| Personal Data | Email address |
| Data Subjects | Users who provided explicit consent |
| Lawful Basis | Consent (Art. 4(2)) — optional opt-in at signup |
| Storage Location | Germany (EU) — Hetzner Online GmbH |
| Retention | Until consent withdrawn or account deleted |
| Security | Encrypted storage, restricted access |
| Recipients | None |
| Opt-out | Email support@buyorsell24.com or delete account |
Processing Activity 4: Payment Processing
| Field | Detail |
|-------|--------|
| Purpose | Process subscription payments |
| Personal Data | Billing name, email (payment card details handled by processor) |
| Data Subjects | Paid plan subscribers |
| Lawful Basis | Contractual necessity (Art. 4(1)) |
| Storage Location | Processed by payment provider (Stripe) |
| Retention | 5 years (UAE legal requirement) |
| Security | PCI-DSS compliant processor |
| Recipients | Stripe (payment processor) |
Processing Activity 5: AI Analysis
| Field | Detail |
|-------|--------|
| Purpose | Provide AI-powered property analysis, market reports |
| Personal Data | None — AI processes property data only (no PII) |
| Data Subjects | N/A |
| Lawful Basis | N/A |
| Storage Location | Germany (EU) — local Ollama inference |
| Retention | N/A |
| Security | Local inference only; no data sent to third-party AI APIs |
| Recipients | None |
---
Data Protection Impact Assessment (DPIA)
A DPIA has been conducted for all processing activities. Key findings:
- Risk Level: Low (minimal personal data collected)
- Cross-border transfer: Adequate safeguards in place (EU-Germany data centers with contractual protections)
- Data minimization: Only essential data collected; no special category data
- Consent management: Separate consent for marketing; easy withdrawal
Updates
This register is reviewed quarterly. Last review: July 2026.