Data Export and Privacy Compliance (GDPR & UAE Law)

You own your data. TenancyDesk provides comprehensive export and privacy controls to ensure compliance with UAE data protection laws, GDPR, and real estate industry regulations.

Legal Framework

UAE Federal Law No. 45 of 2021 (Data Protection)

The UAE's first comprehensive data protection law, effective January 2022, applies to all personal data processed in the UAE.

Key requirements:

• Lawful basis: Consent or legitimate business interest for processing
• Purpose limitation: Data used only for stated purposes
• Data minimization: Collect only what's necessary
• Security: Appropriate technical measures to protect data
• Rights: Data subjects can access, correct, and delete their data

How TenancyDesk complies:

• Clear consent collection for tenant data
• Purpose-specific data processing (rental transactions only)
• Secure storage with encryption (AES-256 at rest)
• Data subject access requests via admin panel
• Documented retention and deletion policies

GDPR (EU Data Protection)

If you have tenants from EU countries, GDPR also applies to their personal data.

Additional GDPR requirements:

• Right to be forgotten: Delete data upon request
• Data portability: Export data in machine-readable format
• Breach notification: Report breaches within 72 hours
• Processing agreements: Contracts with data processors

TenancyDesk GDPR compliance:

• Data export in JSON/CSV (machine-readable)
• Deletion tools for data subject requests
• Breach notification procedures documented
• Data Processing Agreement (DPA) available on request

Dubai/Ejari-Specific Requirements

Rental transaction data has special retention requirements:

TenancyDesk auto-manages: We track retention periods and notify you when data can be deleted.

---

Data Export Options

Accessing Export Tools

Settings → Account → Data Export

Available to: Admin role only (for security)

Export Formats

1. JSON (JavaScript Object Notation)

Best for: Importing to other systems, API integrations, developers

What's included:

{
  "deals": [...],
  "contacts": [...],
  "properties": [...],
  "documents": [...metadata only, not files],
  "payments": [...],
  "tasks": [...]
}

Use case: Migrating to another system, backup, analytics

---

2. Excel (XLSX)

Best for: Analysis, reporting, sharing with accountants

Structure: Multiple sheets

• Sheet 1: Deals (all deals with key fields)
• Sheet 2: Contacts (tenants, landlords)
• Sheet 3: Properties (all property records)
• Sheet 4: Payments (payment schedule and status)
• Sheet 5: Tasks (all tasks with completion status)

Use case: Monthly reports, tax preparation, portfolio analysis

---

3. CSV (Comma-Separated Values)

Best for: Universal compatibility, database imports

Output: Separate CSV files per entity type

• deals.csv
• contacts.csv
• properties.csv
• payments.csv

Use case: Import to Excel, Google Sheets, databases

---

4. PDF Reports

Best for: Printing, sharing with non-technical stakeholders

Available reports:

• Deal summary report (per deal or all deals)
• Payment collection report
• Compliance status report
• Team activity report

Use case: Board meetings, investor updates, audits

---

What's Included in Exports

All Deals (active and completed):

• Complete deal details (rent, commission, duration)
• Workflow history (draft ← active ← ejari pending ← completed)
• Compliance scores and violation log
• Internal notes and custom fields

All Parties (tenants, landlords, properties):

• Complete contact information
• Document copies (Emirates ID, passport, trade license)
• Transaction history across deals
• Blacklists and flags

All Documents (as ZIP file):

• Contracts (signed PDFs)
• Ejari certificates
• Payment receipts
• Deal Portal uploaded documents
• Legal notice outputs

Payment Records:

• Payment schedules and status per installment
• Cheque details (cheque number, bank, due date)
• Collection logs
• Late payment and penalty history

Communications Log:

• Emails sent (templates + content)
• SMS and WhatsApp logs
• Deal Portal notifications
• Timestamps and sender IDs

Compliance Reports:

• RERA Rental Index Calculator logs
• Legal notices generated (90-day, 12-month)
• Dispute evidence packages (for RDC)
• Violations and resolutions

Audit Trail:

• Every change to every record (who, when, what)
• Permission changes and team access
• Login attempts and IP log
• API calls and Webhook events

---

Export Size and Processing Time

Small Agencies (<50 deals):

• Export size: 20-50 MB
• Processing time: Instant (< 30 seconds)
• Delivery: Immediate download link in browser

Medium Agencies (50-200 deals):

• Export size: 50-200 MB
• Processing time: 5-10 minutes
• Delivery: Email link (valid 48 hours)

Large Agencies (200+ deals):

• Export size: 200 MB - 2 GB
• Processing time: 15-30 minutes
• Delivery: Secure email download link (valid 48 hours)

Download link: Sent to your email, valid for 48 hours (security). After 48 hours, need to request new export.

---

Document Downloads

Documents are exported separately for security and file size reasons.

How to export documents:

1. Settings → Data Export → "Export Documents"
2. Select date range (e.g., last 12 months)
3. Choose deals (all or selected)
4. Click "Generate ZIP"
5. Download link sent via email (large files)

File organization:

documents_export_2025-12-26/
├── deal_abc123/
│   ├── tenant_emirates_id.pdf
│   ├── contract_signed.pdf
│   └── title_deed.pdf
├── deal_def456/
│   └── ...

---

Data Retention Policy

Automatic Retention Management

TenancyDesk tracks retention requirements automatically:

Retention Notifications

TenancyDesk notifies you:

• 90 days before retention period ends
• When data is eligible for deletion
• When deletion is completed

Admin action required: Confirm deletion or extend retention

Manual Data Deletion

Delete specific records:

1. Navigate to the record (contact, deal, etc.)
2. Click "Delete" (Admin only)
3. Confirm deletion
4. Record is soft-deleted (30-day recovery period)
5. After 30 days: Permanent deletion

Bulk deletion:

1. Settings → Data Export → "Data Cleanup"
2. Select criteria (e.g., "Deals completed before 2018")
3. Review records to be deleted
4. Confirm bulk deletion

---

Data Subject Rights

Right of Access

When a tenant or landlord requests their data:

1. Go to Contacts → Find the person
2. Click "Export Data"
3. Select format (PDF recommended for individuals)
4. Download includes:
   • Personal information stored
   • Deals they're party to
   • Documents uploaded by them
   • Communication history

Response time: We recommend responding within 30 days (GDPR requirement).

Right to Correction

If data subject reports incorrect data:

1. Navigate to their contact record
2. Click "Edit"
3. Update incorrect fields
4. Save changes
5. Audit log records the correction

Common corrections: Name spelling, phone number, Emirates ID update

---

Right to Portability

Data portability allows data subjects to receive their personal data in a machine-readable format and transfer it to another controller.

How to provide:

1. Settings → Data Export
2. Select format: JSON or CSV (machine-readable)
3. Filter by specific contact/tenant
4. Download and provide to data subject
5. They can import to any other system

Example: Tenant switching from your system to another agency → Export their data in JSON format, provide file, they import elsewhere.

Timeline: Provide within 30 days of request (GDPR requirement)

---

Right to Deletion ("Right to be Forgotten")

When can you delete?

• No active deals involving this person
• No outstanding payments
• Retention period expired
• Cannot delete during active tenancy
• Cannot delete if financial obligations pending

How to process deletion request:

1. Verify identity of requester
2. Check for active deals/payments
3. If eligible: Contacts → Find person → Delete
4. Confirm deletion
5. Send confirmation to requester

What's deleted:

• Personal contact information
• Communication history
• Document metadata

What's retained (anonymized):

• Deal records (with "[DELETED USER]" reference)
• Payment history (for accounting)
• Audit logs (for compliance)

---

Audit Logs

What's Logged

Every significant action is recorded:

• User logins (timestamp, IP, device)
• Deal creation, edits, deletions
• Document uploads and downloads
• Contact changes
• Payment status updates
• Settings modifications
• Role changes

Accessing Audit Logs

Settings → Security → Audit Log

Filters available:

• Date range
• User
• Action type (create, edit, delete, view)
• Entity type (deal, contact, document)

Exporting Audit Logs

For compliance audits or legal requirements:

1. Settings → Security → Audit Log
2. Apply filters (date range, etc.)
3. Click "Export Log"
4. Select format (CSV or JSON)
5. Download file

Use cases:

• RERA compliance audit
• Internal security review
• Dispute resolution (who accessed what)
• GDPR data subject access request

---

Third-Party Data Processing

TenancyDesk as Data Processor

When you use TenancyDesk, we act as a data processor on your behalf.

Our commitments:

• Process data only as you instruct
• Implement appropriate security measures
• Notify you of any data breaches
• Delete data upon contract termination
• Assist with data subject requests

Data Processing Agreement (DPA)

Enterprise clients can request a formal DPA that documents:

• Data processing scope and purposes
• Security measures implemented
• Sub-processor list
• Breach notification procedures
• Data return/deletion upon termination

Request DPA: Contact legal@tenancydesk.com

Sub-Processors

TenancyDesk uses these sub-processors:

Updates: Sub-processor list changes are notified 30 days in advance.

---

Security Measures

Technical Security

Encryption:

• Data at rest: AES-256 encryption
• Data in transit: TLS 1.3
• Database: Encrypted backups

Access control:

• Role-based permissions (RBAC)
• Two-factor authentication (2FA)
• Session timeout (configurable)
• IP allowlisting (Enterprise)

Infrastructure:

• AWS Middle East data center
• Continuous infrastructure monitoring
• Automated alerting and incident response

Organizational Security

TenancyDesk team:

• Background checks for all employees
• Security training mandatory
• Access to customer data: Need-to-know basis
• Regular security audits

---

Best Practices for Data Management

Recommendations from data security experts:

1. Regular Data Audits

• Review stored data every 6 months
• Delete unnecessary data (data minimization)
• Audit who has access to what data

2. Encryption and Security

• TenancyDesk encrypts everything (at rest: AES-256, in transit: TLS 1.3)
• Use 2FA for all team accounts
• Review access logs weekly

3. Data Retention Policies

• Define clear retention periods (7 years for leases, 3 years for leads)
• Auto-archive + delete old data
• Exceptions for legal requirements

4. Team Training

• Train team on handling data requests
• SOPs for access, deletion, correction requests
• Know who to contact (DPO or legal support)

---

Common Questions

Q: Can I export all my data if I cancel TenancyDesk? A: Yes. You have 30 days after cancellation to export all data. After 30 days, data is deleted per our retention policy.

Q: Is my data stored in the UAE? A: Yes. Primary data storage is AWS Middle East (Bahrain), with backups in UAE-approved locations.

Q: Who can see my company's data at TenancyDesk? A: Only support staff with specific need (for troubleshooting). All access is logged and audited.

Q: How do I respond to a GDPR data subject request? A: Use the export and deletion tools in Settings. We recommend responding within 30 days.

Q: What happens to my data if TenancyDesk shuts down? A: Our terms include 90-day notice and full data export before any service termination.

---

Your data, your control. TenancyDesk provides the tools — you maintain ownership and compliance.