Trevio Affiliate – Privacy Policy

Effective date: 5 October 2026Version 1.1

1. Who we are and what this policy covers

This Privacy Policy explains how Trevio Commercial Broker LLC ("Trevio", "we", "us" or "our") collects, uses, shares and protects personal data through our website gotrevio.com and our referral portal, Trevio Affiliate (together, the "Platform").

Trevio Commercial Broker LLC is a limited liability company licensed in Dubai, United Arab Emirates, with its registered office at 472-0, Al Barsha-373-1313, Al Barsha First, Dubai. Trevio is the controller of the personal data described in this policy.

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and any other law that applies to us.

This policy applies to:

Visitors who browse our website.
Customers who ask us to help them obtain a mortgage or other financing facility.
Affiliates (individuals and companies) who register on Trevio Affiliate to refer potential customers.
Referred Leads, meaning people whose details an Affiliate submits to us.

In this policy, "personal data" means any information that identifies, or can identify, a living individual.

2. Personal data we collect

We collect only the data we need for the purposes in Section 3. What we collect depends on how you deal with us.

Who you areData we collect

VisitorIP address, device and browser type, pages viewed, referring site, cookie identifiers, and anything you enter in an enquiry form

AffiliateName, email address and IBAN (for commission payments), plus your portal login details and a record of your referrals and commission payments

Referred LeadName, mobile number and email address, either submitted by the Affiliate or entered by you through an Affiliate's referral link, and a record of which Affiliate referred you

Customer (a Referred Lead or direct enquirer who proceeds with us)Information we collect directly from you to assess your profile and complete the bank application form, such as contact details, nationality, residency status, Emirates ID and passport, date of birth, employment and income details, bank statements, existing liabilities, credit report, property details, and any other documents your chosen bank requires

Sources. A Referred Lead's name, mobile number and email address come either from the Affiliate or from the lead directly through an Affiliate's referral link. Everything else about a customer we collect directly from the customer after contacting them, from the bank handling their application, and from credit bureaus such as Al Etihad Credit Bureau where the customer consents. We also collect website data automatically through cookies and similar technologies.

Sensitive data. We do not ask for sensitive personal data (such as health or religious information) unless a lender requires it for an application, for example life insurance linked to a mortgage. In that case we collect it only with your explicit consent.

3. How we use personal data and why

We use personal data only where the PDPL allows it. The table shows each purpose and the legal basis we rely on.

PurposeLegal basis

Contacting Referred Leads to introduce our services and qualify their financing needsConsent confirmed by the referring Affiliate, and the lead's own consent at first contact

Assessing a customer's profile, presenting suitable bank options, completing the bank application form and submitting it to the bank the customer choosesPerforming our service for the customer, and the customer's consent

Registering Affiliates and running their portal accountsPerforming the Affiliate agreement

Tracking referrals, confirming loan disbursement, and calculating and paying commission to the Affiliate's IBANPerforming the Affiliate agreement

Checking new referrals against our existing records (by mobile number and email) to prevent duplicates and credit the correct AffiliatePerforming the Affiliate agreement and our legitimate interests

Reviewing content Affiliates publish to promote their referral link, to check it follows our Marketing GuidelinesPerforming the Affiliate agreement

Anti-money laundering, sanctions and fraud checks on customers, as banks and the law requireLegal obligation

Responding to enquiries and complaintsPerforming our service and our legitimate interests

Running, securing and improving the PlatformOur legitimate interests, and consent for non-essential cookies

Sending marketing about our servicesYour consent, which you can withdraw at any time

Meeting tax, accounting, regulatory and court requirementsLegal obligation

We do not sell personal data. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Lenders may use their own automated credit scoring, which is governed by their privacy notices.

4. Who we share personal data with

We share personal data only where needed for the purposes above, and only with:

Banks and lenders you choose, after we present suitable options based on your profile, and to which we submit your application on your behalf.
Property valuers, conveyancers, insurers and trustees involved in completing a financing transaction.
Credit bureaus, including Al Etihad Credit Bureau, where you have consented to a credit check.
Service providers who host, operate or support the Platform, such as cloud hosting, CRM, email, analytics, identity verification and payment providers. They act on our instructions and must protect the data.
Professional advisers, such as auditors, lawyers and accountants.
Government, regulatory and law enforcement authorities, where the law requires it or to protect our legal rights.
A buyer or successor if Trevio's business is sold, merged or restructured, under equivalent privacy protections.

Affiliates and customer data. We do not share a Referred Lead's financial details, documents or credit information with the Affiliate who referred them. We may tell the Affiliate the status of a referral (for example "in progress", "disbursed" or "declined") and the loan amount used to calculate commission, unless the customer objects. If a referral is rejected as a duplicate, we do not tell the Affiliate who the existing record belongs to or who referred them.

Transfers outside the UAE. Some service providers may store or process data outside the UAE. We transfer data abroad only where the PDPL permits it, such as to countries with adequate data protection, under contractual safeguards, or with your consent.

5. If you were referred to us

If you submitted your details through an Affiliate's referral link, we will tell the Affiliate the status of your referral as described in Section 4. If an Affiliate gave us your details on your behalf, they must have told you they were doing so and obtained your consent first. Our Affiliate Terms require this.

When we first contact you, we will tell you who referred you and how to reach this policy. If you do not want to hear from us, tell us and we will stop contacting you and delete your details, except for a minimal record so we do not contact you again.

If you believe an Affiliate submitted your details without your consent, please contact us using the details in Section 6.

Affiliates: by submitting a referral, you confirm that the person agreed to their details being shared with Trevio for the purpose of being contacted about mortgage or financing services.

6. Retention, security, cookies and your rights

How long we keep data

We keep personal data only as long as we need it. Customer records (including identity documents and application files) and Affiliate commission and payment records are kept for at least five years after the relationship ends, as UAE anti-money laundering and commercial record-keeping laws require. Referred Lead details that do not become a customer are deleted within 12 months of the referral. Website analytics data is kept for up to 26 months.

How we protect data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls and role-based permissions, secure hosting and staff confidentiality obligations. No system is completely secure. If a breach is likely to affect your rights, we will notify you and the relevant authority as the PDPL requires.

You are responsible for keeping your Trevio Affiliate login details confidential.

Cookies

We use essential cookies to run the Platform, keep you signed in, and record which Affiliate's referral link brought you to us so the referral is credited correctly. With your consent, we also use analytics and marketing cookies. You can accept or refuse non-essential cookies through our cookie banner and change your choice at any time in your browser settings.

Your rights

Subject to the PDPL, you have the right to:

Get information about and a copy of your personal data.
Have inaccurate data corrected.
Have your data erased where we no longer need it or have no legal basis to keep it.
Restrict or object to certain processing, including direct marketing.
Receive your data in a structured, machine-readable format and have it transferred.
Withdraw consent at any time, without affecting earlier processing.

To exercise a right, email info@gotrevio.com. We may ask you to verify your identity. We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the UAE Data Office.

Children

The Platform is not intended for anyone under 21. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. The latest version will always be on the Platform with its effective date. If a change is significant, we will notify registered users by email or through the portal.

Contact us

Trevio Commercial Broker LLC Address: 472-0, Al Barsha-373-1313, Al Barsha First, Dubai, United Arab Emirates Email: info@gotrevio.com Phone: +971 52 204 9898

Effective date: 5 October 2026