Privacy Policy

Arzan Investment Management (DIFC) Limited and Arzan Investment Management Limited

Introduction

‍

We recognise the importance of your privacy and understand your concerns about the security of your Personal Data. We are committed to ensuring that when you share Personal Data with us or we collect Personal Data about those who visit our websites, we do so in accordance with applicable and relevant privacy laws and principles.

‍

This Privacy Notice details how we generally collect, hold, use and disclose Personal Data, your rights in relation to the Personal Data that we hold about you and the third parties to whom it may be disclosed. We do this in compliance with our obligations as a data controller under the Dubai International Financial Centre (“DIFC”) Data Protection Law No.5 of 2020 (“DPL”).

‍

In respect of individuals whose personal data is protected under the law of the United Kingdom, this Privacy Notice is also issued to comply with our obligations under the UK General Data Protection Regulation and the Data Protection Act 2018 (together, “UK Data Protection Law”).

‍

It is important that you read and retain this notice, together with any other Privacy Notice we may provide on specific occasions.

‍

Any reference to “us”, “our”, “we” or “the Company” in this Privacy Notice is a reference to Arzan Investment Management (DIFC) Limited or Arzan Investment Management Limited, as applicable depending on which entity you are dealing with. Arzan Investment Management (DIFC) Limited acts as data controller of Personal Data processed in connection with its DIFC-regulated business, and Arzan Investment Management Limited acts as data controller of Personal Data processed in connection with its UK business. Each entity is independently responsible for its own Processing of Personal Data as the context requires, and neither acts as a joint controller with the other. Arzan Investment Management Limited is an appointed representative of Capricorn Fund Managers Limited, which is authorised and regulated by the UK Financial Conduct Authority.

‍

The Privacy Notice may form among other documents an integral part of the master agreement we have with you.

‍

This Privacy Notice applies to the following individuals (“you”):

  • Our past, present and prospective clients;
  • Website users;
  • Anyone involved in any transaction or interaction with us, whether it is in your personal capacity or as a representative of a legal entity (for example, director, a company manager, agent, legal representative, operational staff, other authorized representative, etc.); and
  • Our advisors, consultants or secondees.

‍

Personal Data Processing

‍

Personal Data means any information about an individual from which that person can be identified, directly or indirectly. It does not include data where the identity has been removed (anonymous data).

‍

We collect your Personal Data from various sources, such as through our company website, consent driven mailing lists for marketing purposes, and our interactions with you.  We may also obtain Personal Data from other sources, background and/or identity checks or via cookies on our website.

‍

The Personal Data processed by the Company depends on the purpose for such processing.

‍

  • Clients, potential clients and any third-parties that interact with us:
    • As part of our due diligence and onboarding processes and to comply with ongoing legal obligations on anti-money laundering and counter terrorist financing, taxation, crime detection, crime prevention, investigation, the prevention of fraud, bribery, anti-corruption, tax evasion; we may process Personal Data such as name, signature, postal address, email address, date and place of birth, nationality, professional or employment related information, source of funds/wealth details, tax identification, signatures, other contact details, account numbers (or functional equivalent) and transaction details (including transactions with our affiliates), your tax or other government issued ID numbers, utility bills for the purposes of address verification, photographic identification and verification such as copies of your passport, passport number and driver’s license, information relating to your status as an ultimate beneficial owner of an entity, a politically exposed person or a designated individual on a sanctions list.
    • We may collect and process Personal Data relating to you in connection with our on-going relationship with you, such as via correspondence and calls, and in connection with the administration of our relationship with you. Telephone calls with you may be recorded for the purposes of record keeping, security and training.
    • We Process your Personal Data for the purpose of delivering a service to you, for the purpose of maintaining appropriate business records, including maintaining appropriate registers required under applicable law and regulation, for the purpose of quality control, data security, business and statistical analysis, market research, to meet our internal and external audit requirements, for the purpose of tracking fees and costs and for the purpose of customer service.
  • Website, applications and other social media platform visitors:
    • when you visit our website, we may collect certain technical data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
      Where we set non-essential cookies, we also provide you with an option to accept, reject or manage cookies that may be dropped on your device while you navigate our website. Details of the cookies set by our website can be found in the section on ‘cookies’ below.
    • We also invite you to contact us and, in this regard, we request your name, email address and the reason for contacting.
    • We process your social media platform account details when you connect with us there.
  • Attendance at our offices and events:
    • we also collect and process your name, contact details, image, in relation to your attendance at our offices or at an event or seminar organised by the Company or our business partners.

Our website is not targeted, intended or expected to be of use to children. Apart from providing information for specific services or purposes, as directed by processes, user-provided contributions of content or contact information regarding or about children are expressly prohibited.

‍

If you choose not to provide the Personal Data we request, we may not be able to provide you with the product or service you need.

‍

Legal Basis for Processing

‍

We only use your Personal Data under one of the following legal grounds [Please UPDATE as required]:

  • To conclude and carry out a contract with you
  • To comply with our legal obligations such as:
    • to comply with our obligations under applicable law and regulations, which may include laws and regulations outside your country of residence;
    • to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence; and
    • to carry out anti-money laundering, sanctions or Know Your Customer (“KYC”) checks as required by applicable laws and regulations.
  • For our legitimate business interests, the legitimate interests pursued by us in this regard include:
    • conducting our business in a responsible and commercially prudent manner and dealing with any disputes that may arise
    • preventing, investigating or detecting theft, fraud or other criminal activity
    • pursuing our legitimate corporate and ethical, social, and governance responsibility
    • to maintain good commercial relations with all our customers and other concerned parties
    • conducting our business in a responsible and commercially prudent manner and dealing with any disputes that may arise
    • to protect our rights, privacy, safety, property, or those of other persons.
  • When we have your consent.

The equivalent legal bases available to us under UK Data Protection Law are set out in Article 6 of the UK GDPR and correspond directly to the grounds listed above.

‍

Special Categories of Personal Data

‍

“Special Categories" of particularly sensitive Personal Data require higher levels of protection. We have in place safeguards in compliance with the law. We are likely to Process Special Categories of Personal Data based on the following justifications where:

  • in limited circumstances, we have your explicit written consent;
  • it is necessary for performance of the contract you enter into with us;
  • it is necessary to comply with the law applicable to us in relation to anti-money laundering or counter-terrorist financing obligations or the prevention, detection, or prosecution of any crime; or
  • it is necessary for the compliance with specific requirements pursuant to laws applicable to us.

We envisage that we may hold information about criminal convictions.  We will only collect Personal Data about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. For example, when performing screening for anti-money laundering purposes.

‍

Where this data relates to individuals protected under UK Data Protection Law, it is treated as “criminal offence data” under Article 10 of the UK GDPR and Schedule 1 to the Data Protection Act 2018, and we maintain an appropriate policy document governing our processing of that data in addition to this Privacy Notice.

‍

Less commonly, we may Process this type of Personal Data where it is needed in relation to legal claims, where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

‍

For marketing purposes, we would not obtain Special Categories of Personal Data, however, if we do, we will issue a separate notice on how we would use the data.

‍

Your Consent

‍

In general, we do not rely on consent as our Processing reason and also would not require consent if we use Special Categories of your Personal Data in accordance with our written policy to carry out our legal obligations.

‍

In limited circumstances, we may approach you for your written consent to allow us to Process certain particularly sensitive data. If we do so, we will provide you with full details of the Personal Data that we would like and the reason we need it so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your relationship with us that you agree to any request for consent from us and that you have the right to withdraw your consent for that specific Processing at any time, and this will not affect the lawfulness of Processing before the consent has been withdrawn.

‍

With whom do we share your Personal Data and for which reasons

‍

To comply with our regulatory obligations, we may disclose Personal Data to the relevant government, supervisory and judicial authorities such as:

  • Public authorities, regulators and supervisory bodies such as the financial sector supervisors in the countries in which we operate.
  • Tax authorities may require us to report customer assets or other Personal Data such as your name and contact details and other information about your organization, for this purpose, we may Process your data such as your tax identification number or any other national identifier in accordance with applicable local law.
  • Judicial/investigative authorities such as the police, public prosecutors, courts and arbitration/mediation bodies on their express and legitimate request.

‍

When we use third parties to carry out certain activities in the normal course of business, we may have to share Personal Data required for a particular task. For instance:

  • IT service providers who may provide application or infrastructure (such as cloud) services;
  • Marketing activities or events and managing customer communications;
  • Legal, auditing or other services provided by lawyers, notaries, trustees, company auditors or other professional advisors;
  • Identifying, investigating, or preventing fraud or other misconduct by specialized companies.

‍

We may also share Personal Data with Group entities for administrative purposes. Personal Data in the form of ID documents, KYC data and financial information may be shared with the Group as a pre-contractual or contractual measure.

‍

The third parties or group entities may be located in a jurisdiction that does not have the same level of data protection as the DIFC. In such cases the third parties or group entities will be required to abide by standard data protection clauses or the Personal Data transfer may be subject to a lawful derogation.  You may ask us for further details of these safeguards, where required.

Where Personal Data is transferred from the United Kingdom to a jurisdiction that is not the subject of UK adequacy regulations, we will put in place an appropriate transfer mechanism recognised under UK Data Protection Law, such as the International Data Transfer Agreement issued by the UK Information Commissioner’s Office or the UK Addendum to the European Commission’s Standard Contractual Clauses.

‍

Companies acting on our behalf are required to keep your Personal Data confidential.

‍

How we protect your Personal Data

‍

We take our obligations to protect your Personal Data from unauthorised access, loss, misuse, modification or unauthorised disclosure seriously and as such we take reasonable steps to hold Personal Data securely in electronic form.

‍

We have appropriate technical and organisational measures in place to safeguard your Personal Data. Once we receive your Personal Data, we will take reasonable steps to use technical measures to prevent unauthorised access, modification or disclosure, and take steps to protect the Personal Data we hold from interference, misuse, loss, unauthorised access, modification or unauthorised disclosure.  Measures include but are not limited to role-based access controls, strict password protocols, training, encryption, data protection and information security policies and procedures. Some electronic communications through non-secure web platforms may not be secure, virus- free or successfully delivered. If you communicate with us using a non-secure web platform, you assume the risks that such communications between us are intercepted, not received, delayed, corrupted or are received by persons other than the intended recipient.

‍

How long do we keep your Personal Data?

‍

We will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, compliance, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we Process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. We have a Retention Policy which outlines the applicable periods.

‍

What happens if we make changes to this Privacy Notice

‍

If we change this Privacy Notice we will post the changes on this website, therefore please check back regularly to ensure you are aware of any changes to our Personal Data Processing operations. The changes will take effect as soon as they are posted on our website.

‍

Use of Artificial Intelligence (AI), Automated Decisions and Profiling

‍

We use Artificial Intelligence (AI) in specific, limited ways to enhance the efficiency and accuracy in our operations. However, we do not make decisions based solely on automated processing. There is always human oversight, and all decisions are reviewed and confirmed by trained employees. Personal data processed through AI tools is handled in accordance with DIFC Data Protection Law (DIFC Law No. 5 of 2020), and your rights to access, rectify, or erase your data are fully maintained.

‍

Cookies

‍

During your interaction with our website, we may use cookies to improve security, enhance functionality, and remember your preferences. A cookie is a small text file containing a unique identification number that helps our website recognise your browser and respond accordingly

.

We use essential cookies to enable core website functionality and maintain the security of our systems. These cookies help distinguish between legitimate users and potentially malicious traffic, support website performance, prevent abuse, and ensure that requests are processed securely. The information collected through these cookies may include online identifiers and technical information required for security and operational purposes. Such cookies are retained only for as long as necessary to perform these functions.

‍

These cookies do not track your browsing behaviour. You may choose to adjust your browser settings to refuse cookies or to notify you when a cookie is being set. Please note, however, that certain cookies are essential for the operation and security of the website. If these cookies are disabled, some parts of the website may not function as intended.

In the United Kingdom, our use of cookies is also governed by the Privacy and Electronic Communications Regulations 2003 (as amended).

‍

Direct Marketing

‍

We may use your Personal Data to offer you products and services that we believe may interest you. If you do not wish to receive marketing offers from us, you can let us know by emailing us at contactaim@arzanim.com. Note however that we have no control over the way social media sites target and market our paid advertising, to its audience.

‍

What are your rights and how do we respect them

‍

Under certain circumstances, and where the conditions specified in the DIFC DPL are met, by law, you have the right to: The equivalent rights, and the equivalent conditions for exercising them, are available to you under the UK GDPR where UK Data Protection Law applies to you.

‍

  • Request access to your Personal Data. This enables you to receive a copy of the Personal Data  we hold about you and to check that we are lawfully Processing it.
  • Request rectification of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us to continue to Process it.
  • Right to be notified regarding rectification or erasure of Personal data or restriction of processing- unless it has a disproportionate effect
  • Object to Processing of your Personal Data. You have the right to object to the processing of your personal data in certain circumstances.
  • Request the restriction of Processing of your Personal Data. This enables you to ask us to suspend the Processing of Personal Data about you, for example, if you want us to establish its accuracy or the reason for Processing it.
  • Data portability enables you to receive or request transfer of the data you have provided us in a structured, commonly used and machine-readable format.
  • Object to automated Processing, including profiling which produces legal or other seriously impactful consequences concerning you. However, note that as we do not conduct automated decision making, this right is not applicable.
  • Right to not to be discriminated against for exercising the rights mentioned above.

If you choose to exercise your rights, we may need to request specific Personal Data from you to help us confirm your identity and ensure your right to access the Personal Data (or to exercise any of your other rights). This security measure ensures that Personal Data is not disclosed to an unauthorised person.

‍

You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances, where permitted by law.

‍

Upon your request we will remove your personal contact details from our database, however, you may continue to receive promotional emails from our other websites, providers, or other non-affiliated marketers whose services you may have accessed via Arzan Investment Management website. You can request them directly to remove your data from their system.

‍

Complaints, concerns, and exercising your rights

‍

If you have any concerns or questions regarding this notice, you may contact our Data Protection Officer(“DPO) through the contact methods below.

‍

dp@arzanim.com

‍

Penthouse-1 External, Level 7, Gate Village Building 08

‍

DIFC, Dubai, United Arab Emirates

‍

We will make every effort to resolve your complaint internally and as soon as practicable and as prescribed by law. However, if we are unable to satisfactorily resolve your complaint you have the right to make a complaint to the DIFC Data Protection Commissioner.

‍

DIFC Data Protection Commissioner Contact Details :

‍

Telephone   :     +971 4 362 2222

‍

Address        :     Dubai International Financial Centre Authority

                             Level 14, The Gate Building, DIFC, UAE

                             commissioner@dp.difc.ae

‍

If UK Data Protection Law applies to you, you also have the right to make a complaint to the UK Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, telephone +44 303 123 1113, ico.org.uk. Arzan Investment Management Limited is registered with the ICO (registration reference: C2028753).