Data Controller
The data controller for personal data collected through the Site is LEGATHERIST - FZCO, trading as "Le Gatherist", incorporated in the United Arab Emirates (commercial licence no. 91007, DIEZA), with registered office at DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE.
Data protection contact: legal@legatherist.com — subject "Personal Data".
Scope
This policy applies to all personal data collected through the Site, its forms, private spaces and any communications related to Le Gatherist services, whether the person concerned is a visitor, prospective client, client, property owner, professional partner or third-party contact.
Paid service contracts are governed by their own specific documents, which may contain additional provisions regarding personal data.
Data Collected
Depending on the purpose of the interaction, LEGATHERIST may collect the following categories of data:
- Identification & contact: first name, last name, email address, phone number, country.
- Enquiry & project: type of request, destination, travel dates, number of guests, budget range, property requirements, messages submitted.
- Property owner: property name and address, photos, floor area, amenities, availability, desired visibility, identity of the owner or representative.
- Commercial relationship: quotes, booking confirmations, contracts, invoices, payments processed by external providers.
- Technical & browsing: approximate IP address, browser type, pages visited, interactions, session identifiers — used for site security, audience analytics and advertising measurement where consent has been given.
- Marketing preferences: newsletter subscription status and consent records.
LEGATHERIST does not systematically collect sensitive data (health, ethnic origin, political opinions, etc.). Where such data is incidentally necessary — for example, dietary requirements for an event — it is collected with appropriate safeguards.
Lawful Bases
LEGATHERIST processes personal data on the following bases:
- Consent: marketing communications, non-essential cookies and advertising measurement.
- Pre-contractual measures: processing enquiries and preparing proposals before a contract is signed.
- Contract performance: organising stays, concierge services, events and related services.
- Legitimate interest: site security and fraud prevention, internal administration, defence of legal rights, and certain analytics.
- Legal obligation: tax, accounting and regulatory requirements.
Purposes & Data Used
| Purpose | Data used | Basis |
|---|---|---|
| Respond to an enquiry or booking request | Identity, contact, preferences, dates, budget, request content | Pre-contractual; legitimate interest |
| Evaluate and present a property proposed by an owner | Address, characteristics, photos, availability, desired visibility | Pre-contractual; legitimate interest; contract if concluded |
| Organise a stay or service | Booking data, occupants, special requests, payments, communications | Contract performance; legal obligations |
| Facilitate a real estate project with authorised professionals | Search criteria, budget, timeline, contact details | Pre-contractual; consent for sharing where required |
| Secure the Site and prevent fraud | Technical logs, device, approximate IP, security events | Legitimate interest; security obligations |
| Send marketing communications | Contact details, marketing preferences | Consent or other authorised legal basis |
| Measure audience and personalise advertising | Cookie identifiers, browsing data, interactions, ad data | Consent |
| Comply with law and defend rights | Data strictly necessary for audit, evidence or litigation | Legal obligation; legitimate interest |
Mandatory & Optional Fields
Fields marked as required are necessary to process the relevant request. Without them, LEGATHERIST may not be able to respond, prepare a proposal or provide a service.
Information intended for marketing or non-essential cookies remains optional.
Recipients
To the extent necessary, data may be shared with:
- LEGATHERIST teams and advisers
- Property owners, agencies and authorised real estate professionals
- Concierge and event service providers
- Vercel, Inc. — website hosting and delivery infrastructure
- Supabase — database, media storage and back-office infrastructure
- CRM, email, analytics, advertising, payment and security providers
- Regulatory authorities and legal counsel
Personal data is not sold. Where a provider acts on its own behalf — such as a real estate agency or experience operator — they provide their own privacy policy.
International Transfers
LEGATHERIST is established in Dubai and operates with international partners; data may therefore be processed in the United Arab Emirates, the United States (Vercel and Supabase infrastructure), the European Economic Area and other countries relevant to a given request. Where the GDPR applies, LEGATHERIST relies on appropriate transfer mechanisms, including adequacy decisions and standard contractual clauses issued by the European Commission, together with supplementary measures where required.
Retention Periods
| Category | Period or criterion |
|---|---|
| Prospects & enquiries without contract | 3 years from collection or last contact initiated by the person |
| Owner files without collaboration | 3 years from last exchange, then deletion or anonymisation |
| Contracts, bookings & client files | Duration of the relationship, then archiving up to 10 years where required by law, accounting or rights defence |
| Payment data | Strictly necessary duration for the transaction and disputes; full card data remains with the payment provider |
| Electronic marketing | Until consent is withdrawn or 3 years from last active contact; opt-out record kept at least 3 years |
| Security logs | 12 months, unless an incident or obligation requires longer retention |
| Cookie choices | 6 months before re-solicitation, unless a material change requires earlier re-consent |
Security & Confidentiality
LEGATHERIST implements measures proportionate to the risk: access control, encrypted communications, backups, limited authorisations, vendor management, logging and incident response procedures. No system is entirely immune; users should avoid sending sensitive data through unrequested channels.
Your Rights
Subject to applicable law, you may request: access to your data, rectification, erasure, restriction or cessation of certain processing, opposition to marketing, withdrawal of consent, and — where conditions are met — data portability. Withdrawal of consent does not affect prior lawful processing.
Requests should be addressed to legal@legatherist.com with the subject "Personal Data". LEGATHERIST may request reasonable proof of identity and will respond within the applicable legal time frame.
Complaints
You may contact LEGATHERIST in the first instance. You may also lodge a complaint with the competent data protection authority in the United Arab Emirates or, where the GDPR applies, with the supervisory authority of your place of residence, workplace or the alleged infringement.
Direct Marketing
Every marketing message includes an unsubscribe mechanism. Preferences can also be updated by writing to legal@legatherist.com. Service, security and contractual communications may continue after a marketing opt-out.
Cookies & Trackers
Cookies and trackers are managed in accordance with our Cookies Policy. Non-essential technologies are only activated after a valid choice has been made, where required by law.
Minors
The Site's forms and commercial services are not intended for direct use by persons under 18. Information concerning children participating in a stay is collected from their legal guardian and only where necessary for the organisation of that stay.
Automated Decision-Making
LEGATHERIST does not make, through the Site, decisions producing legal effects based exclusively on automated processing. Tools may assist in classifying or routing an enquiry, under human supervision.
Updates to this Policy
This policy may be updated to reflect changes to the Site, providers or regulations. The published version shows its update date. Additional notice will be provided when a change materially affects how data is used.