Privacy Policy

1. Introduction

Arvo Limited (“Arvo”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you access or use our website, mobile application, investor dashboard, property crowdfunding platform, onboarding tools, communications, payment flows and related services (together, the “Platform” or the “Services”).

Arvo operates a DFSA-authorised property investment crowdfunding platform through which eligible investors may review and participate in fractional real estate investment opportunities, subject to registration, client classification, eligibility, appropriateness, anti-money laundering, sanctions, source of funds, source of wealth and other onboarding checks.

This Privacy Policy should be read together with our Terms and Conditions, Investor Terms and Conditions, Cookie Policy, Key Risks, Regulatory Disclosure and Risk Warnings, and any other notices provided to you when using the Platform.

By using the Platform or opening an account with us, you acknowledge that we will process your personal data in accordance with this Privacy Policy.

2. Data Protection Framework

Arvo is established in the Dubai International Financial Centre (“DIFC”) and processes personal data in accordance with applicable data protection laws, including the DIFC Data Protection Law, DIFC Law No. 5 of 2020, and the DIFC Data Protection Regulations.

Where other data protection laws apply because of your location, residence or the nature of the processing, we will take appropriate steps to comply with those laws to the extent applicable to us.

For the purposes of applicable data protection laws, Arvo will generally act as a “Controller” in relation to the personal data it collects and uses to operate the Platform and provide the Services.

3. What Personal Data Do We Collect?

The personal data we collect depends on how you use the Platform and your relationship with us. It may include:

1. (a) identity and contact information, including name, email address, telephone number, date of birth, nationality, address, passport or national identity details, proof of address, photograph, selfie and signature;
2. (b) account and security information, including username, password, authentication information, login history, device identifiers and account preferences;
3. (c) KYC, AML and sanctions information, including identity verification results, liveness checks, politically exposed person information, sanctions screening results, adverse media results, source of funds, source of wealth, occupation, employer, income range, expected investment activity and other financial crime risk information;
4. (d) investor profile information, including client classification, investor eligibility, appropriateness assessments, investment objectives, investment experience, risk acknowledgements and investment limit checks;
5. (e) investment and transaction information, including investment commitments, subscriptions, holdings, SPV interests, distributions, transfer requests, exit requests, payment instructions, bank account details, IBAN details, withdrawals, chargebacks, fee records and transaction history;
6. (f) communications information, including emails, calls, messages, support tickets, complaints, enquiries, survey responses and marketing preferences;
7. (g) technical and usage information, including IP address, browser type, device type, operating system, app version, time zone, language settings, pages viewed, session data, clickstream data, security logs and crash logs; and
8. (h) property-related information, where you are a seller, broker, property owner, representative or other supply-side participant, including identity details, licence or registration details, property ownership information, due diligence materials and communications.

We may also create aggregated or anonymised data. Where such data cannot reasonably identify you, it will not be treated as personal data.

4. How Do We Collect Your Personal Data?

We collect personal data in the following ways:

1. (a) directly from you, when you register, complete onboarding, upload documents, make an investment, submit a property opportunity, contact us, participate in a promotion, use Platform features or sign documents;
2. (b) automatically, when you access or use the Platform, including through cookies, technical logs and analytics tools; and
3. (c) from third parties, including identity verification providers, KYC and AML screening providers, sanctions databases, payment providers, banks, open banking providers, property brokers, sellers, valuers, property managers, public registries, Dubai Land Department data sources, document-signing providers, CRM providers, marketing platforms and professional advisers.

5. How Do We Use Your Personal Data?

We use your personal data for the following purposes:

1. (a) to operate, maintain and improve the Platform and the Services;
2. (b) to register users, create accounts, authenticate access and maintain account security;
3. (c) to complete KYC, AML, sanctions, PEP, adverse media, fraud prevention, source of funds and source of wealth checks;
4. (d) to classify clients, assess investor eligibility, apply investment limits and determine whether you may access certain investment information or functionality;
5. (e) to process investment commitments, subscriptions, allocations, transfers, exits, distributions and withdrawals;
6. (f) to administer client money arrangements, payment flows, reconciliations, refunds, chargebacks and financial records;
7. (g) to prepare and provide investment memoranda, property information, periodic statements, portfolio information, performance reports, valuations and transaction documents;
8. (h) to establish, administer and maintain SPVs, share allocations, investor registers and property-related records;
9. (i) to assess property submissions, conduct property-related due diligence and manage relationships with property owners, sellers, brokers and other supply-side participants;
10. (j) to provide customer support, respond to enquiries, handle complaints and resolve disputes;
11. (k) to send service messages, legal notices, regulatory disclosures, security alerts and account updates;
12. (l) to send marketing communications, newsletters, promotions, referral information or educational content, where permitted by law and subject to your preferences;
13. (m) to administer referrals, rewards, promotions, surveys and user engagement tools;
14. (n) to detect, investigate and prevent fraud, cyber incidents, unauthorised access, money laundering, terrorist financing, sanctions breaches, scams and other unlawful activity;
15. (o) to comply with applicable laws, DFSA Rules, DIFC requirements, AML obligations, tax obligations, court orders and regulatory requests; and
16. (p) to enforce our terms, protect our rights, defend legal claims and support business planning or corporate transactions.

6. Lawful Basis For Processing

We process personal data only where we have a lawful basis to do so. Depending on the circumstances, we may rely on:

1. (a) performance of a contract, including to provide the Platform, administer accounts, process investments and payments, and provide investor documentation;
2. (b) compliance with legal and regulatory obligations, including DFSA, DIFC, AML, sanctions, tax, accounting, audit, complaints handling and recordkeeping obligations;
3. (c) legitimate interests, including business operations, security, fraud prevention, customer service, product development, risk management and corporate administration;
4. (d) consent, where consent is required, including for certain marketing communications, optional cookies or certain categories of sensitive processing; and
5. (e) legal claims, where processing is necessary to establish, exercise or defend legal rights.

Where we rely on consent, you may withdraw your consent at any time. This will not affect processing carried out before withdrawal or processing that we are required or permitted to continue on another lawful basis.

7. Sensitive Data and Automated Processing

Because of the regulated nature of our business, we may process sensitive or higher-risk information, including biometric verification outputs, sanctions screening information, PEP information, criminal allegation information, source of funds and source of wealth information.

We process such information only where permitted by applicable law, including for regulatory compliance, financial crime prevention, substantial public interest, legal claims, explicit consent or another lawful basis.

We may use automated or semi-automated tools to support onboarding, identity verification, fraud detection, AML screening, sanctions screening, risk assessment, investor eligibility checks, appropriateness checks, transaction monitoring, property assessment, security monitoring and customer engagement. We maintain appropriate human oversight where required by law or regulation.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Platform, authenticate users, maintain security, remember preferences, analyse usage, improve performance, support marketing and measure communications.

Some cookies are essential for the Platform to function. Other cookies, such as analytics, performance, functional or marketing cookies, may be used where permitted by law and, where required, with your consent.

You can manage cookies through your browser settings or through the “Cookie Settings” preference centre available on the Platform. If you block or disable certain cookies, parts of the Platform may not function properly.

For more information, please refer to our Cookie Policy.

9. Advertising and Analytics

We work with third-party advertising and analytics providers, including Meta and Google, to measure the performance of our advertising and to understand how users find Arvo. With your permission, we share device identifiers such as your Advertising ID, app event data such as installs, sign-ups and investments, and general location at city level with these providers.

This information is used to attribute app installs to specific advertising campaigns and to show you more relevant advertising on their platforms. We do not share your name, contact details or financial information with these providers.

On iOS, you are asked for permission through Apple’s App Tracking Transparency prompt. On Android, you can manage this through your device settings, where you can reset or delete your Advertising ID at any time (for example, Settings > Privacy > Ads). You can change your choice at any time.

On our website, we also use measurement and analytics technologies provided by Google (including Google Analytics and Google Ads), Meta (the Meta Pixel) and Customer.io to understand how the Platform is used and to measure advertising and engagement. Customer.io processes account identifiers, such as your email address, to link your activity on the Platform to your account and to support engagement communications. These technologies operate through cookies and similar technologies, are described in more detail in our Cookie Policy, and can be managed at any time through the “Cookie Settings” preference centre on the Platform.

Meta, Google and Customer.io process this data outside the DIFC. We rely on their standard contractual terms to protect it in line with Articles 26 and 27 of the DIFC Data Protection Law.

10. How Do We Protect Your Personal Data?

We take reasonable technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful processing.

These measures may include encryption, access controls, role-based permissions, multi-factor authentication, audit logs, security monitoring, vulnerability management, web application firewall protections, DDoS mitigation, incident response procedures, vendor due diligence, contractual controls and employee confidentiality obligations.

No system, platform, network or transmission method is completely secure. You are responsible for keeping your account credentials confidential, using strong passwords, maintaining control of your devices and promptly notifying us if you suspect unauthorised access to your account.

11. How Long Do We Retain Personal Data?

We retain personal data for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, administer investments, maintain investor records, comply with regulatory obligations, comply with AML and sanctions requirements, resolve disputes, enforce agreements, maintain audit trails and support legal claims.

In general, records relating to onboarding, KYC, AML, sanctions screening, client classification, investments, payments, client money, transactions, communications, complaints and regulatory matters will be retained for at least six years after the end of the relevant relationship, transaction, investment, account closure or other relevant event, unless a longer period is required or permitted by law.

Where personal data is no longer required, we will take reasonable steps to delete, securely destroy, anonymise or de-identify it, subject to legal, regulatory, technical and operational requirements.

12. Account Closure and Deletion

You may request closure of your Arvo account and deletion of associated personal data by contacting support@arvo.co.

Account closure is subject to our Terms and Conditions. Your account can be closed only once you have no active commitments, no pending transactions, no SPV holdings, no outstanding fees or other amounts due, no remaining account or wallet balance, and no unresolved investigations or other continuing obligations.

Even after account closure, we may retain personal data where required or permitted by law, including for DFSA recordkeeping, AML, sanctions, tax, audit, complaints handling, dispute resolution or legal claims purposes.

We will respond to deletion requests within one (1) month of receipt. Where a request is particularly complex, or requests are numerous, we may extend this period by up to two (2) further months and will notify you of the extension and its reasons within the first month. We may ask for additional information to verify your identity before acting on a request, in which case the response period begins once your identity has been reasonably confirmed. If we refuse, limit or defer your request, we will inform you of the reasons where we are legally permitted to do so, and you have the right to lodge a complaint with the DIFC Commissioner of Data Protection.

13. Who Do We Disclose Personal Data To?

We may disclose personal data where necessary for the purposes described in this Privacy Policy, including to:

1. (a) the DFSA, DIFC authorities, the DIFC Commissioner of Data Protection, the UAE Financial Intelligence Unit, law enforcement agencies, courts, tax authorities, public authorities and other regulators;
2. (b) identity verification, KYC, AML, sanctions, PEP, adverse media, fraud prevention, source of funds and source of wealth screening providers;
3. (c) banks, client money account providers, payment service providers, card acquirers, open banking providers, bank account verification providers and payment processors;
4. (d) cloud hosting providers, cybersecurity providers, software developers, infrastructure providers, authentication providers, CRM providers, document-signing providers, analytics providers and other technology vendors;
5. (e) professional advisers, legal counsel, compliance consultants, auditors, accountants, tax advisers, insurers and risk advisers;
6. (f) SPVs, corporate service providers, registered agents, property managers, valuers, property brokers, property sellers, property owners, developers and other parties involved in property acquisition, management, valuation, transfer or exit processes;
7. (g) business partners, referral partners, marketing partners and service providers, where permitted by law and subject to your preferences; and
8. (h) prospective buyers, investors, lenders, financiers, merger counterparties or restructuring counterparties in connection with a proposed or actual corporate transaction involving Arvo or its business.

We do not sell personal data.

14. International Transfers

Your personal data may be transferred to, stored in or accessed from jurisdictions outside the DIFC, including the United Arab Emirates, the European Economic Area, the United Kingdom, the United States and other jurisdictions where our users, service providers, infrastructure, KYC providers, payment providers, professional advisers or counterparties are located.

Where we transfer personal data outside the DIFC, we will take steps designed to ensure that the transfer complies with applicable data protection laws. This may include using adequate jurisdictions, appropriate contractual safeguards, standard contractual clauses, DIFC-approved safeguards, transfer risk assessments, technical and organisational measures or permitted derogations under applicable law.

15. Marketing, Monitoring and Communications

Where permitted by law, we may send you marketing communications, newsletters, product updates, educational materials, event invitations, surveys, promotions and referral information.

You may opt out of marketing communications at any time by using the unsubscribe instructions in our communications, changing your preferences where available, or contacting us at support@arvo.co.

Even if you opt out of marketing, we may continue to send service, legal, regulatory, security, account, investment, transaction and relationship communications.

To the extent permitted by law, we may record, monitor and retain communications with you for compliance, quality assurance, dispute resolution, training, audit, legal and regulatory purposes.

16. Your Rights

Subject to applicable law and certain exceptions, you may have rights to:

1. (a) access the personal data we hold about you;
2. (b) request correction of inaccurate or incomplete personal data;
3. (c) request deletion or erasure of personal data;
4. (d) restrict or object to certain processing;
5. (e) withdraw consent where processing is based on consent;
6. (f) request transfer of certain personal data;
7. (g) object to certain automated decision-making; and
8. (h) lodge a complaint with the DIFC Commissioner of Data Protection.

To exercise your rights, please contact us at support@arvo.co. We may need to verify your identity before responding to your request.

17. Children and Minors

The Platform and Services are not directed at individuals under 18 years of age. We do not knowingly offer the Services to minors or knowingly collect personal data from individuals under 18.

If we become aware that we have collected personal data from an individual under 18 without an appropriate lawful basis or authority, we will take reasonable steps to delete, disable or de-identify that information, unless retention is required by law, regulatory obligations, security requirements, audit requirements or financial crime prevention obligations.

18. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, payment providers, social media platforms, property platforms, document-signing tools, identity verification providers or other third-party services.

We are not responsible for the privacy practices, security measures, content, terms or policies of third parties. Your use of third-party services may be governed by their own terms and privacy notices.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, the Platform, legal requirements, regulatory expectations, service providers, technology, data processing practices or operational requirements.

Where required by law, we will notify you of material changes through appropriate means, which may include email, Platform notifications, website notices or other communications. The latest version of this Privacy Policy will be made available on the Platform.

20. Relationship with our Terms and Conditions

This Privacy Policy governs how we process personal data. The operation, suspension, termination and closure of your account are governed by our Terms and Conditions.

In the event of any inconsistency, and in each case only to the extent of the inconsistency:

1. (a) applicable law prevails over both this Privacy Policy and the Terms and Conditions; and
2. (b) as between this Privacy Policy and the Terms and Conditions, the Terms and Conditions prevail in respect of the operation, suspension, termination and closure of your account, and this Privacy Policy prevails in respect of the processing of personal data.

21. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights or wish to make a privacy-related complaint, please contact us at:

Arvo Limited: Unit GD-PB-04-01-OF-01-0, Level 1, DIFC Funds Centre, Precinct Building 4, Dubai International Financial Centre

Client support: support@arvo.co
Privacy / Data Protection contact: compliance@arvo.co

You may also contact the DIFC Commissioner of Data Protection in accordance with applicable DIFC data protection laws.