Introduction and scope
Emaar Malls Management LLC and the relevant (holding companies, subsidiaries, and affiliates) referred to as Emaar Group entity that determines why and how your Personal Data is processed (together, as applicable, “Emaar”, “we”, “us” or “our”) respect your privacy and are committed to protecting Personal Data in accordance with applicable data-protection laws, including UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (“UAE PDPL”).
This Privacy Policy applies when you interact with the Dubai Mall website, mobile application, public Wi-Fi, customer-service channels, loyalty and visitor services, events, competitions, parking facilities, security systems and related online or offline services that refer to it (the “Services”). “Personal Data” means information relating to an identified or identifiable individual.
By using a Service, you acknowledge that you have read this Policy. Where consent is required, it will be requested separately and may be withdrawn. Use of a Service does not itself constitute consent to every processing activity described herein.
Who controls your Personal Data
The Emaar entity operating the relevant Service is the controller for that processing. Where another entity is identified at collection, its notice applies. Independent retailers, restaurants, event organisers and third-party providers control their own processing and their privacy notices apply.
Personal Data we collect
Depending on your interaction, we may collect:
- identity and profile information, including name, date of birth, nationality, photograph and government identification where reasonably required;
- contact information, including email address, telephone number and address;
- account, membership, loyalty and preference information;
- transaction, gift-card, payment-confirmation and purchase information;
- enquiries, complaints, correspondence, chat, social-media interactions, survey responses and call recordings;
- tenant, supplier and business-contact information, including authority, role, organisation, contracts and access-pass records;
- event, competition and promotion entries and prize-fulfilment information;
- health, medical, accessibility, accident, incident or emergency information where necessary; and
- content you submit, including photographs, videos, reviews and feedback.
Information collected automatically or at our premises
We may collect:
- device and technical information, such as IP address, device identifier, operating system, browser, language, app version and diagnostics;
- usage information, including pages or features viewed, searches, clicks, session times, referral URLs and crash logs;
- approximate or precise location where enabled or needed for a requested feature;
- cookie, pixel, local-storage and software-development-kit data;
- public Wi-Fi registration, connection and usage information;
- CCTV, access-control and security records, including images, video, audio where lawfully deployed, access logs and incident records;
- vehicle registration marks, entry and exit times, parking, validation and payment records from ANPR and parking systems; and
- aggregated movement and footfall information produced using Wi-Fi, Bluetooth beacons or similar technology. Where practicable, analytics are anonymised or de-identified.
Information from other sources
We may receive Personal Data from Emaar Group entities, retailers, service and parking providers, payment providers, loyalty and airline partners, event organisers, travel and lifestyle partners, analytics and advertising providers, social-media platforms, fraud-prevention services, public authorities, public sources and persons who lawfully refer you to a Service or promotion.
Why we process Personal Data
We process Personal Data only on a lawful ground under applicable law, which may include consent, performance of a contract or requested pre-contract steps, legal obligations, protection of public or vital interests, legal claims, information made public by you or another lawful exception. Where applicable law recognises legitimate interests, we rely on them only after considering your rights.
We process Personal Data to:
- provide, administer, personalise and improve Services, accounts, visitor assistance, delivery or porter services, gift cards, parking, Wi-Fi and digital features;
- respond to enquiries, complaints, incidents and service requests and monitor service quality;
- manage loyalty programmes and requested partner benefits;
- manage purchases, payments, refunds, reconciliation, overdue amounts and fraud prevention;
- administer events, competitions, promotions and prizes;
- manage tenants, suppliers, partners, contracts, access passes and compliance;
- maintain safety, security, access control and loss prevention and investigate incidents;
- manage accidents, emergencies, health and safety, insurance and legal claims;
- operate and enforce parking arrangements;
- analyse performance, footfall and visitor movement using aggregated or de-identified data where practicable;
- send service communications and, where permitted, marketing;
- measure campaigns and personalise content in accordance with your choices; and
- comply with law, court orders, audits and governance and protect legal rights.
Marketing, profiling and choices
Direct marketing will be sent only where permitted by law. Where consent is required, it will be requested separately and will not be inferred merely from use of the Platform or submission of an enquiry.
You may opt out through an unsubscribe link, SMS instruction, app preference or by contacting us. We may retain limited suppression-list information to honour the request. Essential service messages will continue.
We may analyse digital and campaign interactions to understand likely interests. Where automated processing produces a legally or similarly significant decision, we will provide the information and safeguards required by applicable law.
Cookies, Wi-Fi, beacons and location
We use cookies and similar technologies as described in the Cookie Policy or consent tool. Non-essential technologies are used in accordance with applicable consent requirements.
Where Wi-Fi, Bluetooth or mobile signals are used for footfall or movement analytics, we seek to aggregate, anonymise or de-identify results where practicable. Precise location or Bluetooth access is used only where enabled, disclosed and permitted.
CCTV, access control, health and safety
CCTV, access-control, ANPR and related systems may operate in and around malls and car parks for safety, security, access management, loss prevention, incident investigation, parking management, legal compliance and protection of rights. Access is restricted to authorised persons and approved providers.
Health, biometric or other sensitive Personal Data is processed only where necessary and permitted, such as for emergencies, accessibility support, accident management, insurance, health and safety, legal claims or compliance. Additional safeguards apply.
Sharing Personal Data
We may share Personal Data on a need-to-know basis and subject to safeguards with:
- Emaar Group entities supporting or providing the Service;
- hosting, cloud, IT, cybersecurity, analytics, communications, payment, customer-service, concierge, delivery, parking, security, facilities-management, marketing and professional providers;
- retailers, event organisers and loyalty, airline, travel, entertainment or lifestyle partners where necessary for a requested benefit or Service;
- banks, payment networks, insurers, auditors, advisers and fraud-prevention providers;
- government authorities, regulators, courts, law enforcement and emergency services where required or permitted; and
- purchasers, successors or transaction participants in a merger, reorganisation, financing or business transfer, subject to confidentiality and law.
We do not sell Personal Data in the ordinary meaning of selling it for money. Where a law applicable to you treats a disclosure as a sale, sharing or targeted advertising, we provide required choices.
International transfers
Emaar and its providers may process Personal Data in the UAE and other countries. For cross-border transfers, we use measures required by law, which may include an adequate-protection destination, contractual safeguards, intra-group arrangements, valid explicit consent or another lawful mechanism. Contact us for further information about applicable safeguards.
Retention
We retain Personal Data only as long as reasonably necessary for the purposes described, including providing Services, recordkeeping, disputes, agreements, legal, regulatory, tax, accounting, insurance, audit, security and claims requirements.
Retention varies by record type, sensitivity and legal need. CCTV, ANPR, access, Wi-Fi and technical logs follow approved schedules and may be preserved for an incident, investigation, claim or obligation. When no longer required, data is securely deleted, destroyed, anonymised or de-identified.
Security and data incidents
We maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. Measures may include access controls, confidentiality, encryption in transit where appropriate, monitoring, backups, vendor controls and secure disposal.
No internet transmission or storage system is completely secure. You must protect credentials and notify us of suspected misuse. Where required, we will notify the competent authority and affected persons of a qualifying Personal Data breach.
Your rights
Subject to applicable law, identity verification and exceptions, you may have the right to:
- receive information about processing and request access;
- correct or complete inaccurate or incomplete data;
- request deletion where legal conditions apply;
- request restriction or suspension of processing;
- object to certain processing, including direct marketing;
- receive or transfer data in a structured, commonly used and machine-readable format where portability applies;
- withdraw consent without affecting prior lawful processing;
- object to or request human review of certain automated decisions; and
- complain to the competent data-protection authority.
To exercise a right, contact customer.privacy@emaar.ae. We may verify identity and clarify the request. A request may be limited or refused where permitted or required by law, including to protect others, comply with obligations or preserve legal claims.
Children and third-party services
General digital Services are not intended to collect children’s Personal Data without appropriate involvement of a parent or legal guardian. Specific attractions, activities or competitions may have age and parental-consent requirements. Contact us if you believe a child’s data was collected contrary to applicable requirements.
Links or integrations with independent third parties are governed by their own privacy notices. Please review those notices before providing Personal Data.
Updates, contact and complaints
We may update this Policy to reflect changes in law, technology, Services or processing. The revised Policy will be posted with a new effective date. Where required, we will provide additional notice or obtain consent.
Data Privacy Office, Emaar Malls Management LLC, P.O. Box 191741, Dubai, United Arab Emirates. Email: customer.privacy@emaar.ae. Telephone: 800 EMAAR (36227).
You may also complain to the competent data-protection authority where this right is available.
Language
This Arabic version is translated from English. In case of inconsistency or ambiguity, the English version prevails to the extent permitted by applicable law.
