August 2024 MABLEDON CAPITAL LIMITED (MCL) is incorporated in the Dubai International Financial Centre (DIFC) with Registration #2283 and regulated by the Dubai Financial Service Authority (DFSA) with Reference Number F003602.
Our Data Protection Policy outlines how we manage the Personal Data we collect, use, and disclose. MCL is committed to complying with the DIFC Data Protection Law (DIFC Law no 5 of 2020) and DIFC Data Protection Regulations (hereafter referred to as the “Data Protection Law”).
We recognize the importance of protecting Personal Data. This Personal Data Protection Statement explains in a simple and transparent way how Mabledon Capital Limited (in this Statement, “us”, “we” and “our”) collects, uses, and discloses your personal data, and your rights in relation to the personal data it holds. Our approach can be summarized as: the right people use the right data for the right purpose.
Please read this Personal Data Protection Statement so that you know and understand the purposes for which we collect, use, and disclose your Personal Data.
This Personal Data Protection Statement supersedes any previous Statement or equivalent which you may have been provided with or seen prior to the effective date stated above.
This Privacy Statement applies to the following individuals (“you”):
We obtain your personal data as follows:
We collect the following categories of personal data about you:
Special categories of personal data are data relating to your health, ethnicity, religious and political beliefs, genetic or biometric data, or criminal data. We may process your special categories of personal data if:
Processing means every activity that can be carried out in connection with personal data such as collecting, recording, storing, adjusting, organizing, using, disclosing, transferring, or deleting it in accordance with applicable laws. We only use your personal data under one of the following legal grounds:
We may process your data for the following purposes:
Administration
For example, when you wish to become our customer we are legally obliged to collect personal data that verifies your identity (such as a copy of your ID card or passport) and to assess whether we can accept you as a customer. We also need to know your postal, e-mail address or phone number to contact you.
Performance of agreement to which you are a party or taking steps prior to entering into agreements
We use information about you when you enter into an agreement with us or when we have to contact you. We analyze information about you to assess whether you are eligible for our products and services.
Relationship management and marketing
We may ask you for feedback about our products and services, or record your conversations with us online, by telephone or in our office. We may share this with certain members of our staff to improve our offering or to customize products and services for you. If you don’t wish to receive these offers you have the right to object or to withdraw your consent by sending an email or telephoning us (see section “Our Contact Details” below).
Safety and security
We have a duty to protect your personal data and to prevent, detect, and contain any breaches of your data. This includes personal data we are obliged to collect about you, for example to verify your identity when you become a customer. Furthermore, we not only want to protect you against fraud and cybercrime, but we also have a duty to ensure the security and integrity of ourselves and the financial system as a whole by combating crimes like money laundering, terrorism financing, and tax fraud.
Compliance with legal obligations to which we are subject
We process your data to comply with a range of legal obligations and statutory requirements.
To provide you with our services, we share certain data externally with third parties. Whenever we share your personal data externally with third parties in countries without a deemed adequate level of protection for personal data, we ensure the necessary safeguards are in place to protect it. We rely hereby upon, amongst others:
To comply with our regulatory obligations, we may disclose personal data to the relevant government, supervisory and judicial authorities such as:
To process certain financial services, we may have to share information about you and your organization with another bank or specialized financial company. We also share information with financial sector specialists, who assist us with financial services, for instance, in the following cases:
When we use other service providers or third parties to carry out certain activities in the normal course of business, we may have to share personal data required for a particular task. The service providers include:
We respect your individual rights to determine how your personal data is used. These rights include:
Right to be Informed
You have the right to be provided with specified information about the processing of your personal data.
Right to access information
You have the right to ask us for your personal data that we process.
Right of rectification
If your personal data is incorrect or incomplete, you have the right to request us to rectify it. If we shared data about you with a third party and that data is later corrected, we will also notify that party accordingly.
Right to object processing
You can object to us using your personal data for our own legitimate interests (for example, marketing). We will consider your objection and stop processing your data unless we assess that we have legitimate and imperious reasons that justify processing your data. You can also object to receiving commercial messages from us (by e-mail, mail, and phone) or for statistical purposes. When you become our customer, we may ask you whether you want to receive personalized offers. Should you later change your mind, you can choose to opt out of receiving these messages by sending an email to us (see section “Our contact details” below).
Right to object to automated decisions
You have the right not to be subject to decisions which may legally or significantly affect you and that were based solely on automated processing using your personal information. In such cases you may ask to have a person to make the decision instead. Some of our decisions are the result of automated processes for which you gave us explicit consent, or these decisions are necessary to perform or fulfill a contract with you. In both cases, you may ask for human intervention and contest the resulting decision. Your right to object and to contest may be impeded if automated decisions are made for legal reasons.
Right to restrict processing
You have the right to ask us to restrict using your personal data for the period necessary to us for our verifications if:
Right to data portability
You have the right to ask us to transfer some of your personal data directly to you or to another company. This applies to personal data we process by electronic means and with your consent or because of a contract with you. Where technically feasible, we will transfer your personal data.
Right to erasure (also known as right to be forgotten)
Unless required by law, you may ask us to erase your personal data if:
Right to complain
Should you not be satisfied with the way we have responded to your concerns, you have the right to submit a complaint to us. If you are still unhappy with our reaction to your complaint, you can escalate it to our Compliance Department. You can also contact the DIFC Protection Commissioner (DIFC the Gate, Level 14, PO Box 74777, Dubai, T.: +971 4 362 2600)
Exercising your rights
You can also exercise your rights by contacting us (see section “Our contact details” below). We aim to respond to your request as quickly as possible. In some instances, this could take up to one month. Should we require more time to complete your request, we will let you know how much longer we need and provide reasons for the delay. In certain legal cases, we may deny your request. If it’s legally permitted, we will let you know in due course why we denied it.
In some cases, we are legally required to collect personal data, or your personal data may be needed before we may perform certain services and provide certain products. We undertake to request only the personal data that is strictly necessary for the relevant purpose. Failure to provide the necessary personal data may cause delays or lead to refusal of certain products and services.
We take appropriate technical and organizational measures (policies, procedures, IT security, etc.) to ensure the confidentiality and integrity of your personal data and the way it’s processed. We apply an internal framework of policies and minimum standards across our business to keep your personal data safe. These policies and standards are periodically updated to keep them up to date with regulations and market developments. In addition, our employees are subject to confidentiality obligations and may not disclose your personal data unlawfully or unnecessarily. To help us continue to protect your personal data, you should always contact us if you suspect that your personal data may have been compromised.
We will only retain your personal data for as long as we have a lawful reason to do so. In particular:
When your personal data is no longer necessary for a process or activity for which it was originally collected, we delete it, or bundle data at a certain abstraction level, render it anonymous and dispose it in accordance with the applicable laws and regulations.
We may amend this Privacy Statement to remain compliant with any changes in law or to reflect how our business processes personal data.
You can address your queries regarding this Privacy Statement to: Mabledon Capital Limited
Suite 508, Gate District 5, DIFC, PO Box 507093, Dubai, UAE
+971 4 442 8846
You can also address your queries or complaints to our Compliance Officer: Jason Kumar
Suite 508, Gate District 5, DIFC, PO Box 507093, Dubai, UAE
+971 52 989 3443
Our Data Protection Policy outlines how we manage the Personal Data we collect, use, and disclose. MCL is committed to complying with the DIFC Data Protection Law (DIFC Law no 5 of 2020) and DIFC Data Protection Regulations (hereafter referred to as the “Data Protection Law”).
We recognize the importance of protecting Personal Data. This Personal Data Protection Statement explains in a simple and transparent way how Mabledon Capital Limited (in this Statement, “us”, “we” and “our”) collects, uses, and discloses your personal data, and your rights in relation to the personal data it holds. Our approach can be summarized as: the right people use the right data for the right purpose.
Please read this Personal Data Protection Statement so that you know and understand the purposes for which we collect, use, and disclose your Personal Data.
This Personal Data Protection Statement supersedes any previous Statement or equivalent which you may have been provided with or seen prior to the effective date stated above.
- SCOPE OF THIS PRIVACY STATEMENT
This Privacy Statement applies to the following individuals (“you”):
- Our past, present, and prospective customers;
- Anyone involved in any transaction or interaction with us, whether it is in your personal capacity or as a representative of a legal entity (for example, director, company manager, agent, legal representative, operational staff, other authorized representative, etc.); and
- Our employees, advisors, consultants, or secondees.
- HOW DO WE OBTAIN YOUR PERSONAL DATA?
We obtain your personal data as follows:
- From the information you provide to us when you meet or interact with us;
- From information about you provided to us by your company or an authorized intermediary;
- When you communicate with us by telephone, fax, email, or other forms of electronic communication. In this respect, we may monitor, record, and store any such communication;
- When you complete (or we complete on your behalf) client onboarding or application or other forms;
- From your agents, advisers, intermediaries, and custodians of your assets; or
- From publicly available sources or from third parties, most commonly where we need to conduct background checks about you.
- WHAT TYPES OF PERSONAL DATA DO WE PROCESS?
We collect the following categories of personal data about you:
- Your name and contact information such as your home or business address, email address, telephone number, and social media contact details;
- Biographical information which may confirm your identity including your date and place of birth, tax identification number, national insurance number, your passport number or national identity card, and visa details, country of domicile and/or your nationality;
- Information relating to your financial situation such as income, expenditure, assets and liabilities, sources of wealth, as well as your bank account details;
- Information about your knowledge and experience in the investment field;
- An understanding of your goals and objectives in procuring our services;
- Information about your employment, education, family or personal circumstances, and interests, where relevant;
- Know our customer data as part of customer due diligence and to prevent fraudulent conduct or behavior that contravenes sanctions and to comply with regulations against money laundering, terrorist financing, and tax fraud; and
- Where applicable and legally permissible audio-visual data such as surveillance videos, recording of phone or video calls or chats with our employees or offices. We can use these recordings to verify telephone orders, for fraud prevention, or staff training purposes.
Special categories of personal data are data relating to your health, ethnicity, religious and political beliefs, genetic or biometric data, or criminal data. We may process your special categories of personal data if:
- We have your explicit consent to do so; or
- We are required or allowed to do so by applicable local law (for instance to comply with money laundering and terrorism financing monitoring: we monitor your activity and may report it to the competent regulatory authorities).
- WHAT DO WE DO WITH YOUR PERSONAL DATA?
Processing means every activity that can be carried out in connection with personal data such as collecting, recording, storing, adjusting, organizing, using, disclosing, transferring, or deleting it in accordance with applicable laws. We only use your personal data under one of the following legal grounds:
- To conclude and carry out a contract with you;
- To comply with our legal obligations;
- For our legitimate business interests. This data processing may be necessary to maintain good commercial relations with all our customers and other concerned parties. We may also process your data to prevent and combat fraud and to maintain the security of your transactions and the operations made by us;
- When we have your consent. In this case, you may withdraw your consent at any time.
We may process your data for the following purposes:
Administration
For example, when you wish to become our customer we are legally obliged to collect personal data that verifies your identity (such as a copy of your ID card or passport) and to assess whether we can accept you as a customer. We also need to know your postal, e-mail address or phone number to contact you.
Performance of agreement to which you are a party or taking steps prior to entering into agreements
We use information about you when you enter into an agreement with us or when we have to contact you. We analyze information about you to assess whether you are eligible for our products and services.
Relationship management and marketing
We may ask you for feedback about our products and services, or record your conversations with us online, by telephone or in our office. We may share this with certain members of our staff to improve our offering or to customize products and services for you. If you don’t wish to receive these offers you have the right to object or to withdraw your consent by sending an email or telephoning us (see section “Our Contact Details” below).
Safety and security
We have a duty to protect your personal data and to prevent, detect, and contain any breaches of your data. This includes personal data we are obliged to collect about you, for example to verify your identity when you become a customer. Furthermore, we not only want to protect you against fraud and cybercrime, but we also have a duty to ensure the security and integrity of ourselves and the financial system as a whole by combating crimes like money laundering, terrorism financing, and tax fraud.
Compliance with legal obligations to which we are subject
We process your data to comply with a range of legal obligations and statutory requirements.
- WITH WHOM DO WE SHARE YOUR PERSONAL DATA AND FOR WHICH REASONS?
To provide you with our services, we share certain data externally with third parties. Whenever we share your personal data externally with third parties in countries without a deemed adequate level of protection for personal data, we ensure the necessary safeguards are in place to protect it. We rely hereby upon, amongst others:
- The conclusion or the execution of an agreement, a transaction or a third-party transaction in your favor;
- Requirements based on applicable local laws and regulations;
- When applicable, we use standardized contractual clauses in agreement with service providers to ensure personal data transferred to countries without an adequate level of protection for personal data comply with the DIFC Data Protection Law or GDPR, as applicable.
- Data transfer that are necessary for reasons of public interest;
- Your explicit consent;
- International treaties that protect personal data transferred to certain service providers abroad.
To comply with our regulatory obligations, we may disclose personal data to the relevant government, supervisory and judicial authorities such as:
- Public authorities, regulators and supervisory bodies such as the financial sector supervisors in the countries in which we operate.
- Tax authorities may require us to report customer assets or other personal data such as your name and contact details and other information about your organization. For this purpose, we may process your identification data such as your tax identification number or any other national identifier in accordance with applicable local law.
- Judicial/investigative authorities such as the police, public prosecutors, courts and arbitration/mediation bodies on their express and legitimate request.
To process certain financial services, we may have to share information about you and your organization with another bank or specialized financial company. We also share information with financial sector specialists, who assist us with financial services, for instance, in the following cases:
- Exchanging secure financial transaction messages;
- Payments and credit transactions worldwide;
- Processing electronic transactions worldwide;
- Settling domestic and cross-border security transactions and payment transactions; or
- Other financial services organization including stockbrokers, custodians, fund managers, fund administrators and portfolio service providers.
When we use other service providers or third parties to carry out certain activities in the normal course of business, we may have to share personal data required for a particular task. The service providers include:
- IT service providers who may provide application or infrastructure (such as cloud) services;
- Marketing activities or events and managing customer communications;
- Preparing reports and statistics, printing materials and designing products;
- Placing advertisements on apps, websites and social media;
- Legal, auditing or other special services provided by lawyers, notaries, trustees, company auditors or other professional advisors;
- Identifying, investigating or preventing fraud or other misconduct by specialized companies.
- WHAT ARE YOUR RIGHTS AND HOW DO WE RESPECT THEM?
We respect your individual rights to determine how your personal data is used. These rights include:
Right to be Informed
You have the right to be provided with specified information about the processing of your personal data.
Right to access information
You have the right to ask us for your personal data that we process.
Right of rectification
If your personal data is incorrect or incomplete, you have the right to request us to rectify it. If we shared data about you with a third party and that data is later corrected, we will also notify that party accordingly.
Right to object processing
You can object to us using your personal data for our own legitimate interests (for example, marketing). We will consider your objection and stop processing your data unless we assess that we have legitimate and imperious reasons that justify processing your data. You can also object to receiving commercial messages from us (by e-mail, mail, and phone) or for statistical purposes. When you become our customer, we may ask you whether you want to receive personalized offers. Should you later change your mind, you can choose to opt out of receiving these messages by sending an email to us (see section “Our contact details” below).
Right to object to automated decisions
You have the right not to be subject to decisions which may legally or significantly affect you and that were based solely on automated processing using your personal information. In such cases you may ask to have a person to make the decision instead. Some of our decisions are the result of automated processes for which you gave us explicit consent, or these decisions are necessary to perform or fulfill a contract with you. In both cases, you may ask for human intervention and contest the resulting decision. Your right to object and to contest may be impeded if automated decisions are made for legal reasons.
Right to restrict processing
You have the right to ask us to restrict using your personal data for the period necessary to us for our verifications if:
- You believe the information is inaccurate;
- we are processing your personal data unlawfully;
- you have objected to us processing your personal data for our own legitimate interests;
- you have the same right if we no longer need your personal data, but you want us to keep it for use in a legal claim.
Right to data portability
You have the right to ask us to transfer some of your personal data directly to you or to another company. This applies to personal data we process by electronic means and with your consent or because of a contract with you. Where technically feasible, we will transfer your personal data.
Right to erasure (also known as right to be forgotten)
Unless required by law, you may ask us to erase your personal data if:
- We no longer need it for its original purpose;
- You withdraw your consent for processing it;
- You object to us processing your data for our own legitimate interests (except for legitimate and compelling interests) or for commercial messages; or
- we unlawfully process your personal data.
Right to complain
Should you not be satisfied with the way we have responded to your concerns, you have the right to submit a complaint to us. If you are still unhappy with our reaction to your complaint, you can escalate it to our Compliance Department. You can also contact the DIFC Protection Commissioner (DIFC the Gate, Level 14, PO Box 74777, Dubai, T.: +971 4 362 2600)
Exercising your rights
You can also exercise your rights by contacting us (see section “Our contact details” below). We aim to respond to your request as quickly as possible. In some instances, this could take up to one month. Should we require more time to complete your request, we will let you know how much longer we need and provide reasons for the delay. In certain legal cases, we may deny your request. If it’s legally permitted, we will let you know in due course why we denied it.
- ARE YOU OBLIGED TO PROVIDE US WITH YOUR PERSONAL DATA?
In some cases, we are legally required to collect personal data, or your personal data may be needed before we may perform certain services and provide certain products. We undertake to request only the personal data that is strictly necessary for the relevant purpose. Failure to provide the necessary personal data may cause delays or lead to refusal of certain products and services.
- HOW DO WE PROTECT YOUR PERSONAL DATA?
We take appropriate technical and organizational measures (policies, procedures, IT security, etc.) to ensure the confidentiality and integrity of your personal data and the way it’s processed. We apply an internal framework of policies and minimum standards across our business to keep your personal data safe. These policies and standards are periodically updated to keep them up to date with regulations and market developments. In addition, our employees are subject to confidentiality obligations and may not disclose your personal data unlawfully or unnecessarily. To help us continue to protect your personal data, you should always contact us if you suspect that your personal data may have been compromised.
- HOW LONG DO WE KEEP YOUR PERSONAL DATA?
We will only retain your personal data for as long as we have a lawful reason to do so. In particular:
- where we have collected your personal data as required by anti-money laundering legislation, including for identification, screening and reporting, we will retain that personal data for six years after the termination of our relationship, unless we are required to retain this information by another law or for the purposes of court proceedings; or
- otherwise, we will in most cases retain your personal data for a period of ten years after the termination of our contractual or other relationship with you in case any claims arise out of the provision of our services to you.
When your personal data is no longer necessary for a process or activity for which it was originally collected, we delete it, or bundle data at a certain abstraction level, render it anonymous and dispose it in accordance with the applicable laws and regulations.
- CHANGES TO THIS PRIVACY STATEMENT
We may amend this Privacy Statement to remain compliant with any changes in law or to reflect how our business processes personal data.
- OUR CONTACT DETAILS
You can address your queries regarding this Privacy Statement to: Mabledon Capital Limited
Suite 508, Gate District 5, DIFC, PO Box 507093, Dubai, UAE
+971 4 442 8846
investmentsupport@mabledoncapital.com
You can also address your queries or complaints to our Compliance Officer: Jason Kumar
Suite 508, Gate District 5, DIFC, PO Box 507093, Dubai, UAE
+971 52 989 3443
jason@mabledoncapital.com