Sub-processor Register
Effective date: 30 August 2026العربية
Contents
Operator: HomeHub Portal, trading as HomeHub, licensed by Dubai Economy and Tourism under trade licence number 1629357, with registered address at P.O. Box 70834, Dubai, United Arab Emirates ("HomeHub").
Effective date: 30 August 2026
Version: 1.1, issued 29 August 2026. See clause 7 for what changed and why
1Purpose and status of this register
1.1This register lists each third party engaged by HomeHub to Process Customer Personal Data on the Customer's behalf (each a "Sub-processor") in the course of providing the HomeHub service, being the production of bilingual marketing kits for property listings submitted by licensed UAE real estate brokers and brokerages (the "Service"). Contracted individuals who are treated as Sub-processors are described in clause 5.4 rather than named individually.
1.2This register forms part of, and is incorporated by reference into, the HomeHub Data Processing Addendum (the "DPA"). Capitalised terms not defined here have the meanings given in the DPA. By accepting the DPA, the Customer authorises the engagement of the Sub-processors named in this register, on the terms set out in the DPA and in clause 5 below.
1.3This register supports the sub-processing authorisation and notification obligations that HomeHub owes the Customer under the DPA and under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). It is published on the Legal page of the HomeHub website and is updated in accordance with clause 6. HomeHub makes no claim of certification, approval or registration under the PDPL, and no such scheme currently exists.
1.4This register covers only providers that Process Customer Personal Data on the Customer's behalf. It does not list providers used for HomeHub's own internal purposes as controller, such as banking, accounting, tax and professional advisers, which are described in the HomeHub Privacy Policy.
1.5This register does not vary the DPA. If this register conflicts with the DPA, the DPA prevails to the extent of the conflict.
2Where processing happens
2.1The production of each marketing kit is run from a machine controlled by HomeHub and located in the United Arab Emirates. The model that does the drafting does not run on that machine. The listing text a Customer pastes in and the photographs the Customer uploads are transmitted in full to Anthropic PBC in the United States, which runs the model that reads them and returns the drafted copy to the HomeHub machine. That happens for every kit, and again for any section a human reviewer sends back to be rewritten. Anthropic PBC is named at row 5 of the register in clause 4, and the transfer is a cross-border transfer under the PDPL on the basis stated there.
2.1AEverything else in the production of a kit happens on the HomeHub machine in the United Arab Emirates: the correction and resizing of photographs described in clause 4.4, the design and layout of every slide and the brochure, the human review of the whole kit, and the decision to deliver it. No kit reaches a Customer without a person in the United Arab Emirates approving it.
2.2Storage, hosting, the application database, email delivery, payment processing and the drafting step described in clause 2.1 are performed by the Sub-processors listed in clause 4, every one of which is located outside the United Arab Emirates. This means that Customer listing content, delivered kits and account data are stored and transmitted outside the United Arab Emirates by those Sub-processors even though the steps described in clause 2.1A take place inside it. Where a Sub-processor Processes personal data outside the United Arab Emirates, that Processing is a cross-border transfer under the PDPL, and the transfer basis stated in the register applies.
2.3As at the effective date, the UAE Data Office has published neither a list of jurisdictions with an adequate level of protection nor official standard contractual clauses under the PDPL. Pending their publication, each cross-border transfer listed in this register relies on the contractual safeguards contained in the Sub-processor's own data protection terms, together with the Customer's express consent to the named transfers recorded in the DPA. If the UAE Data Office publishes an adequacy list, official standard contractual clauses or any other prescribed transfer mechanism, HomeHub will cooperate with the Customer to adopt it and will execute any officially issued standard clauses within sixty days of a written request by either party, in accordance with the cross-border transfer clause of the DPA.
3What no Sub-processor receives
3.1No Sub-processor is permitted to use Customer listing content, photographs or delivered kits to train, fine-tune, evaluate or improve any artificial intelligence model. Each Sub-processor is engaged on written terms that restrict its Processing of Customer Personal Data to the provision of its service to HomeHub, save that a Sub-processor may Process data as required by law applicable to it and as necessary to secure, operate, bill and account for its own service. Two rows carry a qualification. The payment service provider in row 3 additionally Processes cardholder data as an independent controller for its own payment, fraud prevention and regulatory purposes, under its own privacy notice and outside HomeHub's instructions. The AI model provider in row 5 receives the whole of the Customer's listing text and photographs, which is the subject of clause 3.4.
3.2Advertising permit numbers, BRN, ORN and registered telephone numbers are supplied by the Customer for reproduction on the deliverables. They are therefore stored and transmitted by the hosting and email providers in rows 1 and 2 as part of Customer submissions and deliverables. HomeHub does not disclose them to any other party. HomeHub does not disclose to any Sub-processor seller, landlord or owner personal data beyond what the Customer has itself included in a submission.
3.3Payment card numbers are captured directly by the payment service provider through its own checkout and are not stored on HomeHub systems. HomeHub receives tokenised references and the billing particulars needed to issue a tax invoice.
3.4What the AI model provider receives and what it may do with it. The model that drafts each kit runs on the provider's own infrastructure, so the provider receives the Customer's listing text and photographs in full, including anything the Customer left in them. What the provider may do with that content is limited by its contract with HomeHub to running the model and returning the draft, together with the security, abuse monitoring and legal compliance processing it performs on its own service. It may not use the content to train, fine-tune or improve a model. The provider offers an account setting that governs this, HomeHub keeps that setting off on the account used for production work, and HomeHub treats keeping it off as a term of the engagement under clause 5.1. The provider retains what it receives for a limited period under its own published terms and then deletes it. It does not publish the content, sell it, or disclose it to any other customer of the provider. HomeHub sends the provider no account data, no billing data and no payment data.
4The register
| # | Sub-processor | What it is used for | Personal data processed | Processing location | Transfer basis |
|---|---|---|---|---|---|
| 1 | Vercel Inc. | Hosting of the HomeHub website and application, storage of Customer submissions (listing text and photographs) and delivered kits, and serving of the private results page through which kits are delivered | Customer account data (name, email, brokerage, BRN, ORN, registered phone number); submitted listing text and photographs, which may incidentally contain personal data of third parties; delivered kit files | United States of America. Content may also be served from edge locations in other jurisdictions, to which the same transfer basis applies | Contractual safeguards in the Vercel data processing agreement, together with the Customer's express consent recorded in the DPA, pending the PDPL instruments described in clause 2.3 |
| 2 | Resend, Inc. | Transactional email delivery: account and billing emails, the delivery email containing the link to the private results page, and renewal reminder notices | Recipient name and email address, email subject and body metadata, delivery events. Listing photographs and kit files are not attached to emails; they are served from the results page | United States of America | Contractual safeguards in the provider's data protection terms, together with the Customer's express consent recorded in the DPA, pending the PDPL instruments described in clause 2.3 |
| 3 | Stripe, Inc. and the Stripe group entity identified at checkout and on the invoice | Card payment collection, subscription billing, invoicing support and payment fraud screening | Cardholder name, payment card details (captured directly by the provider, never by HomeHub), billing address, transaction amount and history | United States of America and Ireland | Contractual safeguards in the provider's data protection terms, together with the Customer's express consent recorded in the DPA, pending the PDPL instruments described in clause 2.3. The provider additionally acts as an independent controller for cardholder data as described in clause 3.1 |
| 4 | Neon Inc. | The application database: customer accounts, seats, plan and billing state, and the index of kits that makes a Customer's own kits reachable from the account dashboard | Customer account data (name, email, brokerage name, ORN, BRN, registered phone number), plan and seat records, order and acceptance records, and kit metadata (job reference, property description line, dates). Listing photographs and kit files are not stored here | United States of America | Contractual safeguards in the provider's data protection terms, together with the Customer's express consent recorded in the DPA, pending the PDPL instruments described in clause 2.3 |
| 5 | Anthropic PBC | The AI drafting step: reading the submitted photographs and the pasted listing text so that the model can extract a structured listing record, draft the English and Arabic marketing copy, and redraft any section a human reviewer sends back | Submitted listing text and photographs in full, which may incidentally contain personal data of third parties, including images of identifiable people and readable vehicle number plates, together with the listing record extracted from them. No account, billing or payment data is sent | United States of America | Contractual safeguards in the provider's data protection and commercial terms, together with the Customer's express consent recorded in the DPA, pending the PDPL instruments described in clause 2.3 |
4.1One hosted AI model provider is engaged, and it is row 5. Anthropic PBC is the only third-party artificial intelligence service that Processes Customer listing content. HomeHub uses no other hosted model, translation, transcription or image-processing service on that content: the Arabic copy is drafted by the same model and edited by a person in the United Arab Emirates, and the photograph work described in clause 4.4 is arithmetic performed on the HomeHub machine. If HomeHub engages another such service, it will be added to this register and notified under clause 6 before it Processes any Customer personal data, and the DPA and the HomeHub Privacy Policy will be corrected at the same time.
4.2Where a Sub-processor is identified by category rather than by legal entity name, the entry will be replaced with the provider's legal name, Processing location and transfer basis before that Sub-processor first Processes any Customer personal data, and the change will be notified under clause 6.
4.3Page view counting, and why it adds no row. HomeHub counts page views on the public pages of its website, being the marketing site in both languages, the United States and United Kingdom pages, the guides, the legal pack and the error pages. The tool is Vercel Web Analytics, supplied by the Sub-processor already at row 1. No measurement is placed on the private results page through which kits are delivered, on the signed-in portal, or on the sign-in and checkout pages, and an automated test in the HomeHub build refuses to publish the website if that stops being true. The tool therefore Processes no Customer Personal Data and is not engaged as a Sub-processor for any: what it Processes is website visitor data for which HomeHub is the controller, and clause 1.4 excludes providers used in that capacity from this register. It is recorded here rather than left out because this clause previously stated as a fact that no analytics provider was in use at all, and that is no longer so. The tool sets no cookie and stores no identifier on a visitor's device. HomeHub uses no session recording, error tracking or advertising technology provider. If any analytics or comparable provider begins to Process Customer Personal Data, it will be added to this register as a row and notified under clause 6 before it Processes any.
4.4Photograph correction is arithmetic, not a model. Submitted photographs are corrected for levels, white balance and sharpness and resized on the HomeHub machine in the United Arab Emirates, by an ordinary image library running a fixed calculation. Nothing in a photograph is generated, added or removed, and no third-party image service Processes them. Photographs go to the provider in row 5 only so that the model can look at them and describe what they show, as that row records.
5What engagement of a Sub-processor means
5.1Each Sub-processor is bound by a written contract imposing data protection obligations that provide substantially the same level of protection for Customer Personal Data as the DPA, to the extent applicable to the service that Sub-processor provides, including confidentiality, security, purpose limitation and deletion.
5.2HomeHub remains fully liable to the Customer for the acts and omissions of each Sub-processor to the same extent as if HomeHub had performed the relevant Processing itself.
5.3The engagement of a Sub-processor does not change the allocation of controller and processor roles set out in the DPA. The Customer remains Controller of the listing content it submits.
5.4Human reviewers, Arabic editors and designers engaged by HomeHub as contractors who access Customer Personal Data are treated as Sub-processors under clause 9.6 of the DPA. They Process Customer Personal Data only within the United Arab Emirates on HomeHub-controlled systems, under written contracts and confidentiality undertakings meeting the requirements of the DPA. They are not named individually in this register, and their engagement is not a cross-border transfer.
6Changes to this register and how customers are notified
6.1HomeHub will give each Customer at least thirty days' prior written notice by email to the account email address before adding a new Sub-processor or replacing an existing one. The notice will identify the new Sub-processor, the service it will perform, its Processing location and the transfer basis.
6.2A Customer may object in writing within thirty days of the notice, on reasonable grounds relating to data protection, in accordance with clause 9.3 of the DPA. The parties will discuss the objection in good faith and HomeHub will work with the Customer to find an alternative. If no alternative is reasonably available and the objection is maintained, the Customer may terminate the affected subscription on written notice, and HomeHub will refund the fees paid for the unused remainder of the current subscription period, calculated pro rata in AED, which is the measure set by clause 9.3 of the DPA. That refund is the Customer's primary remedy for an objection under this clause, and it does not exclude any right the Customer has under UAE law that cannot be excluded.
6.3Where a Sub-processor must be replaced urgently for reasons outside HomeHub's reasonable control, such as the sudden failure or insolvency of a provider, and continuity of the Service cannot otherwise be maintained, HomeHub may make the replacement before the notice period in clause 6.1 has run. The replacement Sub-processor will be engaged on the terms in clause 5.1 before it Processes any Customer Personal Data, HomeHub will notify Customers as soon as reasonably practicable, and the objection right in clause 6.2 then applies from the date of that notice.
6.4Changes that do not add or replace a Sub-processor, such as corrections of names or descriptions, may be made without notice. Every version of this register is archived with its version number and date, and prior versions are available on request.
6.5Questions about this register may be sent to the data protection contact address stated in the HomeHub Privacy Policy.
7Change record for version 1.1
7.1Anthropic PBC has been added at row 5, and the statement that no hosted AI model provider was engaged has been deleted. Version 1.0 of this register said, at clauses 2.1 and 4.1, that Customer listing content was not sent to any third-party artificial intelligence model provider. That was wrong on the day it was published. The drafting step has run on Anthropic's model since the Service began, and every kit produced so far was drafted from listing text and photographs sent to the United States. The same incorrect statement appeared in clauses 5.1, 7.3 and 8.1 of the Privacy Policy, clause 4.2 of the Terms of Service, clause 10.1 of the DPA, item 6 of DPA Annex 2 and the closing paragraph of DPA Annex 3. Clause 10.5 of the DPA needed no change, because it limits transfers to those described in clause 10 and Annex 3; it was simply being breached, since the transfer was described in neither. All of them have been corrected in the same version, in English and in Arabic.
7.2Because the provider was already Processing Customer listing content when version 1.0 was published, the thirty days' prior notice in clause 6.1 could not be and was not given before the fact. HomeHub gives that notice now, by email to the account email address of every Customer who held an account before the date of this version, and treats the objection right in clause 6.2 as running from the date of that notice. A Customer who objects has the rights in clause 6.2 and in clause 9.3 of the DPA, including the pro rata refund in AED. For an account opened on or after the date of this version, this version is the register the Customer accepted at sign-up.
7.3Version 1.1 also corrects four disclosures that were incomplete or that described a control HomeHub does not have:
(a)Neon Inc., already at row 4 of this register, was missing from clause 7.2 of the Privacy Policy and from Annex 3 of the DPA. It has been added to both, and the database has been added to the cross-border transfer list in clause 8.1 of the Privacy Policy.
(b)Annex 3 of the DPA described the payment provider by category. It now names Stripe, Inc., as clause 4.2 of this register requires.
(c)Item 5 of DPA Annex 2 and clause 10.1(e) of the Privacy Policy said the delivery link was tied to the delivery email address. It is not. The link carries a 128 bit random token and anyone holding the link can open the kit until it expires. Both places now say so, and both tell the Customer not to forward the link.
(d)Clause 4.5 of the Privacy Policy, the matching row of the clause 9.1 retention table and item 7 of DPA Annex 2 described the refusal and stripping of Emirates ID numbers, passport numbers, financial details and Sensitive Personal Data as an automatic technical control at intake. There is no such automatic control. All three now say what is true: HomeHub requires Customers not to submit that data, and deletes it when a person finds it.
7.4The corrections in clause 7.3 change what this pack says about HomeHub's own systems. They do not add or replace a Sub-processor, so clause 6.4 applies to them and no notice period runs. The addition in clause 7.1 does add a Sub-processor, and clause 7.2 governs it.
7.5Version 1.0 of this register, and version 1.0 of every other document in the pack, is archived and available on request under clause 6.4.
Questions about this document? Contact us at hello@myhomehub.ae.