1. Scope and Legal Framework
This Policy applies to the BuildingCare website, portals and related property-management services operated by ABC. It is intended to support compliance with the Kingdom of Bahrain’s Personal Data Protection Law, Law No. 30 of 2018 (“PDPL”), and applicable implementing orders and decisions.
“Personal Data”, “Data Subject”, “Data Controller”, “Data Processor” and related expressions are used consistently with the PDPL where applicable.
2. Who Is Responsible for Your Data?
ABC as platform operator
ABC operates BuildingCare and may process account, security, support, billing, platform-administration and other information for purposes it determines.
Landlords and property-management companies
A landlord, owner or property-management company using BuildingCare may upload, create or manage personal data relating to its tenants, occupants, staff, workers, contractors, visitors and other persons. Where that customer determines why and how such data is processed, it is responsible for its obligations as Data Controller, and ABC processes the data on its documented instructions to the extent ABC acts as its Data Processor.
3. Personal Data We May Process
| Category | Examples |
|---|---|
| Identity and contact | Name, identification details where required, telephone number, email, nationality or other identity/contact records supplied for legitimate property operations. |
| Account and role | Username, role, organization, property association, account status, authentication and access records. |
| Property and tenancy | Building, flat, room, tenancy dates, occupancy, rent arrangements, deposits, move-in/move-out and inspection records. |
| Financial and payment | Charges, rent records, balances, invoices, receipts, payment references, payment-proof uploads and EWA/utility billing records. BuildingCare should not be used to store full payment-card credentials unless an expressly approved payment service is provided. |
| Maintenance and complaints | Complaint details, photographs/documents, location, urgency, access instructions, work assignments, contractor/worker activity and completion history. |
| Visitors and access | Visitor details, visit information, access records, keys, cards, remotes or other access-related operational records where enabled. |
| Documents and uploads | Lease-related documents, evidence, photographs, inspection files, invoices, receipts and other documents submitted through authorized workflows. |
| Technical and audit | Login records, timestamps, device/browser and security information, audit trails and activity records reasonably required to operate and secure the service. |
Users must not upload unnecessary sensitive personal data. Where sensitive personal data is processed, additional PDPL requirements may apply.
4. Why We Process Personal Data
Depending on the processing activity and the responsible Data Controller, personal data may be processed to:
- create and administer user accounts and access permissions;
- manage properties, tenants, tenancies and occupancy;
- receive, assign, monitor and close complaints and maintenance work;
- manage workers, contractors, assets, utilities, notices and visitor workflows;
- record rent, EWA, charges, payment evidence, invoices and receipts;
- communicate operational notices and service-related notifications;
- maintain security, auditability, backups and service integrity;
- provide support, troubleshoot problems and improve authorized service functionality;
- comply with applicable law, lawful orders and legal obligations; and
- establish, exercise or defend legal rights where permitted.
Processing must have an appropriate basis under the PDPL. Depending on the circumstances, this may include valid consent, performance of or steps connected with a contract, compliance with a legal obligation, protection of vital interests, or a permitted legitimate-interest basis where the applicable legal requirements are met. Consent is not treated as the only possible legal basis.
5. Where Personal Data Comes From
Data may be provided directly by you; entered by your landlord, property manager or authorized organization; generated through your use of BuildingCare; supplied by authorized workers, contractors, finance or security personnel; or derived from property-management records and legitimate operational interactions.
6. Who May Access Personal Data?
BuildingCare uses role-based access. Depending on the relevant workflow and permissions, information may be available to authorized owners/managers, operations personnel, finance users, security/reception personnel, workers, contractors, tenants, ABC personnel who require access for authorized support or administration, and approved service providers.
Access does not mean every role can view every record. Customers are responsible for assigning appropriate users and permissions within their organization.
Personal data may also be disclosed where required by a competent court, Public Prosecution or other authority in accordance with applicable law.
7. Service Providers and Processors
ABC may use carefully selected technology, hosting, communications, security, backup or support providers where necessary to operate BuildingCare. Such providers should receive only the access reasonably required for their services and be subject to appropriate contractual, confidentiality and security obligations where required by law.
The current cloud-hosting arrangement identified for BuildingCare uses Amazon Web Services (AWS), Netherlands region. If the hosting architecture or material processors change, this Policy should be updated accordingly.
8. International / Cloud Processing
BuildingCare data may be hosted or processed outside Bahrain where lawful safeguards and transfer requirements are satisfied. The current identified AWS hosting location is the Netherlands.
Under Bahrain Order No. 42 of 2022, personal data may be transferred directly to countries and territories appearing on the approved adequate-protection list without prior authorization from the Authority. The Netherlands appears on that list. Transfers to other jurisdictions must follow the applicable PDPL and Order No. 42 requirements.
Cloud providers may use supporting infrastructure or subprocessors. ABC should maintain an up-to-date processor/subprocessor record and assess any additional international transfer before use.
9. Data Retention
Personal data will not be retained longer than necessary for the purpose for which it is processed, subject to applicable legal, contractual, accounting, dispute, security, backup and evidentiary requirements. Retention periods may differ by record type.
Where ABC processes customer-controlled data as a Data Processor, retention and deletion may also depend on the customer’s documented instructions and applicable law. Data may remain temporarily in protected backups until the relevant backup cycle expires.
10. Security
ABC applies technical and organizational measures intended to protect personal data against accidental or unauthorized destruction, loss, alteration, disclosure, access and other unauthorized processing. Measures may include role-based access, authentication controls, audit records, secure infrastructure, backups and administrative controls appropriate to the risks.
No online service can guarantee absolute security. Users must protect passwords and access credentials, use only authorized accounts, keep contact information current, log out from shared devices and promptly report suspected unauthorized access.
11. Your Data-Protection Rights
Subject to the PDPL, applicable exceptions and verification of identity, a Data Subject may have rights concerning access to personal data and information about its processing; correction, blocking or erasure in circumstances provided by law; objection to certain processing; withdrawal of consent where processing relies on consent; and protections concerning certain automated processing.
Where the relevant landlord/property-management company is the Data Controller, ABC may refer or transmit your request to that organization for action. Requests can be sent to privacy@adliya-bh.com.
You may also have the right to lodge a complaint with Bahrain’s competent Personal Data Protection Authority in accordance with applicable procedures.
12. Personal Data Breaches and Security Reports
BuildingCare maintains a privacy contact channel for reporting suspected personal-data breaches or security incidents. If you believe personal data has been accessed, disclosed, lost or used without authorization, contact us promptly at privacy@adliya-bh.com or +973 77991388.
ABC and the relevant Data Controller will assess incidents and make notifications required under applicable Bahrain data-protection requirements.
13. Direct Marketing
Service and operational messages necessary for BuildingCare are different from promotional marketing. Where personal data is used for direct marketing, the responsible party must comply with applicable notice, consent/permission and objection requirements. Users should be given an appropriate method to object to or opt out of promotional communications where required.
14. Children and Minors
BuildingCare is designed for property operations and is not directed to children as a consumer service. Customers and users must not create accounts for minors or upload minors’ personal data unless there is a legitimate property-management need and the processing is lawful and appropriately authorized.
15. Changes to This Policy
We may update this Policy when the service, legal requirements, hosting arrangements or processing activities change. The current version and effective date will be displayed on this page. Material changes may also be communicated through BuildingCare where appropriate.
16. Privacy Contact
Adliya Business Center Co. W.L.L.
BuildingCare – Privacy
Kingdom of Bahrain
Email: privacy@adliya-bh.com
Telephone / WhatsApp: +973 77991388