Back to home

Privacy Policy

Last updated: October 5, 2026

This Privacy Policy explains how Arees Brokerage Services LLC SPC ("Unimatched", "we", "us", "our") collects, uses, discloses, and protects personal data when you use the services at unimatched.com.

We are committed to protecting your privacy and complying with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable, the data protection regulations of the Emirate in which you reside.

1. Who we are

Unimatched is a service of Arees Brokerage Services LLC SPC, a company registered in the United Arab Emirates. We help students apply to university programs in Malaysia at no cost to the student; our services are funded by our university partners.

For any questions about this policy or your personal data, contact us at:
Email: contact@unimatched.com

2. Information we collect

2.1 Information you provide directly

  • Account details: first name, last name, email address, phone number, password (stored only as a one-way hash).
  • Verification data: one-time codes we send you to confirm your email address.
  • Referral code (optional) if you were introduced by one of our partners.
  • Application documents: copies of your passport, academic transcripts, English-language test results, and ID photograph that you upload for university applications.
  • Program choices: which university programs you have selected.
  • Consent records: timestamp, IP address, and policy version at the moment you accepted this Privacy Policy.

2.2 Information we collect automatically

  • Session cookies required to keep you signed in and to protect against cross-site request forgery.
  • Technical data: IP address and browser user-agent string, logged when you perform account actions (sign up, log in, submit an application).

3. How we use your information

  • To create and manage your account.
  • To submit your applications to the universities you select.
  • To send transactional emails (verification codes, application status updates).
  • To respond to your enquiries and provide customer support.
  • To comply with legal obligations under UAE law, including record-keeping and responding to lawful requests from authorities.
  • To improve the security and reliability of our service (fraud prevention, failed-login tracking).

We will not use your data for marketing or send you promotional messages without your separate, explicit consent.

4. Lawful basis for processing

Under UAE PDPL, we process your personal data on the following lawful bases:

  • Your consent, which you give when you tick the consent box at signup. You can withdraw it at any time (see Section 8).
  • Performance of a contract — processing is necessary to deliver the application service you asked us to perform.
  • Compliance with a legal obligation to which we are subject.

5. Who we share your data with

5.1 University partners

We share your profile and application documents with the specific universities you select, strictly for the purpose of processing your admission. The universities are independent data controllers for the data they receive; their own privacy policies apply.

5.2 Service providers

  • Resend (resend.com) — delivers transactional email on our behalf. Receives your email address and the content of the email.
  • Cloudflare R2 — stores your uploaded application documents encrypted at rest. Receives your uploaded files.
  • Namecheap / web-hosting.com — hosts the application servers and the MySQL database. Receives everything else.
  • Telegram — receives an internal notification when your application is submitted (contains your name, email, phone, selected programs — no documents).

5.3 Government, legal, and regulatory

We will disclose your personal data to UAE government or regulatory authorities when required to do so by law, by valid court order, or by a mandatory request from a competent authority.

5.4 We do not sell your data

We never sell, rent, or trade your personal data to third parties for their own marketing or advertising purposes.

6. Cross-border transfer of personal data

You should be aware that the service providers above may process your personal data outside the United Arab Emirates:

  • Our hosting provider (Namecheap) operates servers in the United States and the United Kingdom.
  • Our file storage provider (Cloudflare R2) operates globally, with data generally located in the European Union or the United States.
  • Our email provider (Resend) is based in the United States.

By ticking the consent box at signup, you expressly consent to this cross-border transfer in accordance with Article 22(b) of the UAE PDPL. We take contractual and technical safeguards (encryption in transit via HTTPS, encryption at rest, access controls) to protect your data wherever it is stored.

7. How long we keep your data

  • Account data (profile, email, password hash): for as long as your account is active.
  • Application files (passport, transcripts, photo): up to 180 days after a final admission decision (accepted or rejected), after which the files are automatically and permanently deleted from our storage. A short record of the application having existed is kept for audit and anti-fraud purposes.
  • Verification codes: deleted immediately after use or expiry (15 minutes maximum).
  • Audit logs (admin actions, data exports, account deletions): retained for 1 year then purged.
  • Backups: database backups are kept for 30 days then automatically rotated out.

8. Your rights

Under UAE PDPL, you have the right to:

  • Access the personal data we hold about you. You can download a full export of your data at any time from within your account.
  • Rectify inaccurate or incomplete data. You can edit most profile fields yourself; email us for anything else.
  • Erase your personal data ("right to be forgotten"). You can delete your account from within the app, which permanently removes your profile, applications, and uploaded files.
  • Restrict processing in certain circumstances.
  • Object to processing based on consent (by withdrawing consent) or on legitimate interests.
  • Data portability — receive your data in a structured, machine-readable (JSON) format.
  • Withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
  • Lodge a complaint with the UAE Data Office if you believe your rights have been violated.

To exercise any of these rights, email contact@unimatched.com. We will respond within 30 days.

9. How we protect your data

  • All data in transit is encrypted via HTTPS (TLS 1.3).
  • Passwords are stored as one-way bcrypt hashes; we never see or store your plaintext password.
  • Sensitive profile fields (first name, last name, phone number) are encrypted at rest in our database.
  • Uploaded documents are encrypted at rest by Cloudflare R2.
  • Access to admin tools is restricted to a short allowlist of named administrators and every admin action is logged.
  • We use short-lived, signed URLs (5 minutes) for internal document review; downloads are logged.
  • We enforce rate limits and account lockouts to resist brute-force attacks.

10. Children

Our service is intended for prospective university students aged 18 or over. We do not knowingly collect personal data from children under 18. If you believe a minor has created an account, please email us and we will delete the account promptly.

11. Cookies

We use strictly necessary cookies only — specifically, a session cookie that keeps you signed in and a CSRF-token cookie that protects against cross-site request forgery. We do not use advertising, tracking, or analytics cookies.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. If we make material changes, we will notify you by email and require you to re-accept the updated policy on your next sign-in.

13. Contact us

If you have questions about this Privacy Policy or how we handle your personal data:

Arees Brokerage Services LLC SPC
Email: contact@unimatched.com