Privacy Policy

Eland Technologies ("Esset", "we", "us", or "our") values your trust and respects your privacy. This Privacy Policy explains how we collect, store, and use personal information when you access or use the Esset property management platform at esset.io ("Platform").

We will notify you of any material changes to this policy by email or by a notice on our website. You may visit our homepage and landing pages without creating an account or disclosing personal data.

Data Processor and Data Controller Roles

Esset operates as both a data controller and a data processor, depending on the category of data involved:

• Account and billing data — Esset is the data controller. We collect and process your registration details, subscription information, and contact data to operate the Platform and our business.
• Tenant and property data — You (the Customer) are the data controller. You determine what personal data relating to your tenants, residents, or other third parties is entered into the Platform. Esset acts only as a data processor for this data, processing it solely on your behalf and under your instructions. You are responsible for ensuring you have a lawful basis for collecting and entering such data, and for meeting any notice or consent obligations owed to your tenants under applicable law.

General Principle

We will not sell, share, or rent your personal information to any third party for their own marketing purposes, or use your contact details for unsolicited communications. Any communication from Esset will relate to the provision of the Platform and related services, or be sent with your explicit consent.

We may share aggregated, anonymised statistical data — such as aggregate usage trends or platform performance metrics — that cannot be used to identify any individual user.

What Personal Information We Collect

When you use Esset, we may collect and process the following categories of personal information:

• Registration & profile information — your name, email address, phone number, job title, and account credentials provided when signing up.
• Organisation information — your company or business name, registered address, and any documents submitted for identity or KYC verification.
• Billing information — subscription plan details and payment transaction records. Payment card details are handled directly by our payment processors and are not stored on Esset systems.
• Property & tenant data (on your behalf) — lease agreements, rent records, tenant profiles, maintenance logs, and related documents that you upload or enter. You control this data; we process it on your instruction as described in this Policy.
• Communications — messages, support requests, and feedback you send to us.
• Technical information — IP address, browser type, device identifiers, operating system, session duration, and pages viewed, collected through server logs, cookies, and analytics tools.

How We Use Your Information

We use the personal information we control (account and billing data) to:

• Verify your identity during account creation, login, and payment processing.
• Create and manage your account and provide you with access to the Platform.
• Process subscription payments and send billing communications.
• Respond to your support requests, queries, and feedback.
• Detect, investigate, and prevent fraud, security incidents, and misuse of the Platform.
• Comply with applicable legal obligations, including disclosures required by law, regulation, or court order.
• Improve and develop Platform features using aggregated, anonymised usage data.
• Communicate product updates and — where you have given consent — relevant service announcements.

Sub-processors and Third Parties

We engage trusted third-party sub-processors to help deliver the Platform. These parties process personal data only to the extent necessary to perform their specific function and are bound by appropriate data protection obligations. Our current sub-processors are:

We may update this list as our services evolve. We will notify you of any changes to sub-processors that materially affect how your data is processed.

Where Your Data Is Stored and International Transfers

All Platform data is stored and processed on Google Cloud infrastructure in the Bahrain region (me-central1). Google Cloud maintains ISO 27001, SOC 2, and SOC 3 certifications and employs encryption at rest and in transit for all stored data.

Some sub-processors (such as Google Analytics, SendGrid, Twilio, and Meta) may process certain data outside of Bahrain, including in the United States or the European Union. Where data is transferred internationally, we ensure that appropriate safeguards are in place, including standard contractual clauses, adequacy decisions, or equivalent mechanisms recognised under applicable law.

By using the Platform, you acknowledge that your data may be transferred to and processed in countries other than your own. We take reasonable steps to ensure any such transfers are conducted securely and in compliance with applicable data protection law.

Data Retention

We retain personal information for the periods set out below, or for longer where required by applicable law:

How We Protect Your Information

We implement industry-standard technical and organisational measures to protect your personal information, including:

• Encryption of data at rest and in transit using TLS 1.2+ and AES-256.
• Infrastructure hosted on Google Cloud Bahrain with ISO 27001 and SOC 2 certification.
• Role-based access controls so that Esset staff can only access data necessary for their function.
• Regular security assessments and vulnerability monitoring.
• Two-factor authentication available for all user accounts.

Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights or freedoms, Esset will notify affected customers without undue delay and, where required by applicable law, within seventy-two (72) hours of becoming aware of the breach. Notification will be sent to your registered account email address and will describe the nature of the breach, the data affected, and the steps Esset is taking to address it.

Cookies

We use the following categories of cookies on the Esset website and Platform:

• Essential cookies — required for the Platform to function, including authentication sessions, security tokens, and load balancing. These are set automatically and cannot be disabled without breaking core functionality. No consent is required for essential cookies.
• Analytics cookies — we use Google Analytics to understand how visitors use our website. These cookies collect anonymised information about page views, session duration, and navigation patterns. These are only set if you choose "Accept all" on our cookie banner.

You can manage your cookie preferences at any time using the Cookie Preferences link in the footer. For more information about how Google uses data from our site, visit policies.google.com/technologies/partner-sites.

Age Restriction

The Platform is intended for use by businesses and individuals aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us at support@esset.io and we will delete it promptly.

Third-Party Links

The Platform may contain links to third-party websites or services for your convenience. These operate independently of Esset and may have their own privacy policies. We are not responsible for the content, privacy practices, or your use of any linked third-party service. We encourage you to review the privacy policies of any third-party sites you visit.

Your Rights

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at support@esset.io.

All Users

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data, subject to our legal retention obligations.
• Withdraw consent to optional data processing (e.g. analytics cookies) at any time.

EU / EEA Users (GDPR)

• Right to data portability — receive your data in a structured, machine-readable format.
• Right to restrict processing — ask us to limit how we use your data in certain circumstances.
• Right to object — object to processing based on legitimate interests.
• Right not to be subject to solely automated decision-making that significantly affects you.
• Right to lodge a complaint with your local data protection supervisory authority.

California Users (CCPA / CPRA)

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information we have collected from you.
• Right to opt out of the sale or sharing of personal information. Esset does not sell personal information.
• Right to non-discrimination for exercising your privacy rights.
• Right to correct inaccurate personal information.
• Right to limit the use of sensitive personal information.

We will respond to all verified requests within thirty (30) days or such shorter period as required by applicable law. We may need to verify your identity before processing your request.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will notify you of any material change by email to your registered address or by a prominent notice on our website. The "Last updated" date at the top of this page will always reflect the most recent revision.

The current version of this Policy is always available at esset.io/privacy.

Contact

For any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:

• Email: support@esset.io
• Phone: +92 321 667 5200

Eland Technologies — Registered in Pakistan. This policy was last reviewed and updated in April 2026. Platform data is hosted on Google Cloud, Bahrain region.