SAPE SPACE — INTERNATIONAL PRIVACY NOTICE

Regional Supplement for Oman, Qatar, Saudi Arabia, Georgia, Azerbaijan, and Indonesia

Last updated: 29 July 2026

1. Purpose and scope of this Supplement
This Regional Supplement applies to visitors to our website www.sapespace.com, and to clients and prospective clients, who are located in, or whose personal data is otherwise subject to the data protection law of, Oman, Qatar, Saudi Arabia, Georgia, Azerbaijan, or Indonesia. It is to be read together with, and supplements, our main SAPE SPACE Privacy Notice prepared under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, which continues to describe in full the personal data we collect, the purposes for which we use it, and how we protect it. Where this Supplement and the main Privacy Notice conflict on a point specific to your local law, this Supplement prevails for that point.

2. Who is the controller
For visitors and clients located in the countries covered by this Supplement, the data controller is SAPE SPACE REAL ESTATE BROKERAGE L.L.C, a limited liability company registered in the Emirate of Dubai, United Arab Emirates, under trade licence No. 1423374, issued by the Dubai Department of Economy and Tourism (DET), as this is the SAPE SPACE entity that concludes client contracts. Our contact details are set out in Section 6 below.

3. Country-specific information
The information below reflects the current, generally applicable data protection law of each listed country. It does not cover every possible scenario or sector-specific rule, and it may be updated as local law develops.

Oman
Applicable law: Personal Data Protection Law, issued under Royal Decree No. 6/2022, together with its Executive Regulations (Ministerial Decision No. 34/2024), fully enforceable since 5 February 2026.
Regulator: Ministry of Transport, Communications and Information Technology (MTCIT) — Personal Data Protection Department.
Legal basis and consent: Express, written consent is generally required before we process your personal data, and separate written consent is required before we send you advertising or marketing material. Omani law does not recognise “legitimate interest” as an independent basis for processing.
Your local rights: Access, correction, restriction, objection, erasure, data portability, and withdrawal of consent at any time, as well as the right to lodge a complaint with the MTCIT.

Qatar
Applicable law: Law No. 13 of 2016 Concerning Personal Data Privacy Protection (PDPPL).
Regulator: National Cyber Security Agency (NCSA).
Legal basis and consent: Explicit, informed consent is generally required before we process your personal data, in particular for direct marketing communications. Processing of “personal data of special nature” (sensitive data) may additionally require prior approval from the competent authority.
Your local rights: Access, correction, erasure, objection to processing, and withdrawal of consent at any time, as well as the right to lodge a complaint with the NCSA.

Saudi Arabia
Applicable law: Personal Data Protection Law (PDPL), enacted by Royal Decree No. M/19 of 2021 and amended in March 2023, together with its Implementing Regulations, fully enforced since 14 September 2024.
Regulator: Saudi Data & Artificial Intelligence Authority (SDAIA).
Legal basis and consent: Consent is the default lawful basis for processing your personal data. Transferring your personal data outside Saudi Arabia (including to our office in the UAE) is subject to restrictions under the PDPL, and we will only do so with your consent or another safeguard recognised by SDAIA.
Your local rights: Access, correction, deletion, data portability, objection to processing, and withdrawal of consent at any time, as well as the right to lodge a complaint with SDAIA.

Georgia
Applicable law: Law of Georgia on Personal Data Protection, adopted 14 June 2023, with its main provisions in force since 1 March 2024. The law is closely aligned with the EU General Data Protection Regulation (GDPR).
Regulator: Personal Data Protection Service (PDPS).
Legal basis and consent: We process your personal data on the basis of your consent or another recognised legal ground (such as the performance of a contract with you). Explicit consent is required before we send you commercial/marketing communications.
Your local rights: Access, rectification, erasure, restriction, objection to processing, data portability, and withdrawal of consent at any time, as well as the right to lodge a complaint with the PDPS.

Azerbaijan
Applicable law: Law of the Republic of Azerbaijan “On Personal Data” No. 998-IIIQ of 11 May 2010, as amended (most recently on 28 June 2024).
Regulator: Ministry of Digital Development and Transport.
Legal basis and consent: Written consent (including in electronic form) is generally required before we collect or process your personal data, unless collection is otherwise mandated by Azerbaijani law. Withdrawal of consent must be given effect within a reasonable period, after which we will cease processing unless another lawful basis applies.
Your local rights: Access, correction, deletion, objection to processing, and withdrawal of consent at any time.

Indonesia
Applicable law: Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi, “UU PDP”), fully enforced since 17 October 2024.
Regulator: Personal Data Protection Supervisory Agency (Lembaga Pengawas PDP).
Legal basis and consent: We process your personal data on the basis of your explicit consent or another recognised legal ground (such as the performance of a contract with you). Heightened protection applies to sensitive categories of data, including health, biometric, financial, and criminal-record data, and to children's data.
Your local rights: Access, correction, deletion, objection to processing, and withdrawal of consent at any time (requests to correct data or stop processing following withdrawal of consent are generally actioned within 72 hours), as well as the right to lodge a complaint with the Personal Data Protection Supervisory Agency.

4. Cross-border data transfers
SAPE SPACE REAL ESTATE BROKERAGE L.L.C. is based in Dubai, United Arab Emirates, and our systems and staff that handle client and website data are located there. If you are in Oman, Qatar, Saudi Arabia, Georgia, Azerbaijan, or Indonesia, providing us with your personal data will generally involve a cross-border transfer of that data to the UAE. Where your local law requires a specific legal basis or safeguard for such a transfer (for example, your consent, or verification that the receiving country provides an adequate level of protection), we will ensure that basis or safeguard is in place before the transfer takes place, and we apply the data security measures described in our main Privacy Notice to data received from you.

5. Your rights and how to exercise them
In addition to the rights listed for your country in Section 3 above, you may always ask us what personal data we hold about you, request that we correct or delete it, object to particular uses, or withdraw any consent you have given us, subject to the conditions of your local law. To exercise any of these rights, or to raise a question about this Supplement, please contact us using the details in Section 6 below.

6. Contact us
For any questions about this Supplement, the main SAPE SPACE Privacy Notice, or to exercise your rights, please contact SAPE SPACE REAL ESTATE BROKERAGE L.L.C at:
•Address: Control Tower, Office Building, Al Hebiah First, Dubai Motor City, Dubai, UAE
•Phone: +971 58 507 66 26
•Email: broker@sapespace.com
•Website: www.sapespace.com

7. Changes to this Supplement
We may update this Supplement from time to time to reflect changes in the data protection laws of the countries it covers. The “Last updated” date at the top of this Supplement indicates when it was last revised.