Privacy Policy
Approved version · BFREE-PRIVACY-2026-11-06-v3
Effective from the later of 6 November 2026 (UAE time) and first public publication. No retroactive effect.
Who we are
BFREE FZE is responsible for the personal data covered by this notice for the BFREE real estate and precious metals website, client portal and installed web app. Registered address: M 1003, One UAQ, The Business Centre, Al Shmookh Building, Umm Al Quwain Free Trade Zone, PO Box 7072, Umm Al Quwain, UAE. Contact customercare@bfree.care for privacy enquiries. Do not email identity documents or bank details; use the private account upload.
What we collect and why
We receive enquiries, contact and registration details, identity and bank verification records, transaction instructions, cash and metal records, and support correspondence. We record sign-in, device, network and security events, and the version and time of legal acknowledgements. We use these data to respond to enquiries, verify and protect accounts, provide requested services, maintain custody and transaction records, send service notices, resolve disputes and carry out screening and other legal duties where applicable.
Basis for processing
Depending on the purpose and applicable law, processing may be necessary to take steps you request before contracting, perform a contract, comply with a legal obligation or establish or defend legal claims. Where we rely on consent, we ask for it separately and you may withdraw it for future processing. Acknowledging this notice is not consent to optional tracking or marketing. If required information is missing, we may be unable to verify an account or carry out an instruction.
Device sign-in
If you register a passkey, BFREE receives the public key and credential identifier and records security events. Your device checks your face, fingerprint or PIN locally; BFREE does not receive your biometric template or device PIN. Optional device sign-in uses a separate short-lived proof cookie after successful verification. It is not an analytics identifier.
Service providers
Vercel hosts and delivers the website and portal and handles web requests and associated technical data. Supabase provides account authentication, the portal database and restricted storage for private uploads, including identity and transaction evidence. Resend delivers service emails and receives the recipient address and the message needed for delivery. Where used, Google Workspace SMTP sends registration welcome emails, and Google Drive stores encrypted offsite recovery copies. If you enable browser notifications, your browser's push service receives delivery information and an encrypted notification.
Other recipients and international processing
Authorized staff use information as needed for their work. We may share relevant information with banks, dealers, vaults, delivery providers, professional advisers or authorities when needed to carry out a service, meet a legal duty or handle a claim. Providers may process data outside the UAE. Where applicable, transfers must meet the conditions and safeguards required by law. You may ask us for information about recipients and the measures used to protect transfers. See the Cookie Policy for optional analytics and external website resources.
Retention and protection
We keep records only as long as reasonably needed for their purpose and applicable recordkeeping duties, disputes or legal holds. We use account access controls and restricted storage for private documents. No system is risk-free. Keep your credentials private and report suspected unauthorized access promptly.
Your choices and rights
Subject to applicable law and exceptions, you may request information about processing, access or a copy, correction, erasure, restriction, a stop to certain processing, or portability where applicable. You may withdraw consent where it is the basis for processing. Contact us through your account or at customercare@bfree.care. We may verify your identity before responding. You may also complain to the competent data protection authority. See the separate Cookie Policy for device storage and website analytics.