This Privacy Notice ( the “Notice”) describes the ways in which Sanctuary Corporate Services FZ LLC, a member of the Summit Group, through its Dubai branch office and the legal entities listed in Annex 2 (together the "Company",“our” and “we”) processes and protects the personal data of our clients, individuals related to our clients and other business contacts.
The Company is committed to the protection and promotion of individual privacy. This Notice specifically provides relevant information about the Company’s processing of our clients’ (“you” and “your”)personal data in the United Arab Emirates and the Kingdom of Saudi Arabia. In connection with your use of our Services (see below), it is necessary for theCompany to collect, store and use personal data about you for specified purposes in order to provide the Services. The Company complies with the DataProtection laws of the countries where it is established, being the UAE and KSA and other applicable data protection laws, such as the Federal Decree Law No. 44 & 45/2021 (as may be amended and/or supplemented by further implementing regulations) ("UAE DPL"),the ADGM Data Protection Regulations 2021 ("ADGM DPR") and the Royal Decree M/19 of9/2/1443H, Cabinet Resolution No. 98 of 7/2/1443H (as may be amended and/or supplemented by regulatory guidelines issued by the Saudi Authority for Data and Artificial Intelligence in the Kingdom of Saudi Arabia) ("PDPL").
It is important that you read and understand this notice to understand how we will process your personal data and your rights.
The Company is responsible for handling your personal data and is the data controller in respect to your personal data. Our contact details are set out in Section 11 below.
We process data that as a provider of corporate services, personal and business administration, tax advice and related services (the “Services”)from our branches and offices in the United Arab Emirates (the “UAE”),the Abu Dhabi Global Market (the “ADGM”) and the Kingdom of Saudi Arabia(the “KSA”).
The Company processes personal data relating to you necessary for the performance of the agreement with the Company for the Services. The Company endeavors to safeguard personal information and will only collect personal information that is required in order to effectively provide these Services, pursue its legitimate business interests and/or to remain in compliance with all applicable laws.
Where applicable, we will let you know at the time of the data collection, if the provision of the personal data is a statutory or contractual requirement and whether you are obliged to provide personal data and the possible consequences of the failure to provide such data.
We use different methods to collect personal data from and about you including through:
Direct interactions
You may give us your Identity, Contact, Profile and Financial Data by filling informs or by corresponding with us by post, phone, messaging service, email or otherwise.
This includes personal data you provide as part of the provision of:
(a) applying for our Services;
(b) engagement of our Services;
(c) any due diligence / KYC checks;
(d) registration or creation of an account on our website;
(d) communications with us, including email, post, telephone, and social media;
(e) networking;
(f) requesting marketing to be sent to you;
(g) you entering a promotion or survey; or
(h) you giving us feedback or contacting us.
Third parties or publicly available sources
We may obtain personal data about you from various third parties and public sources as set out below:
(a) Contact, Financial and Transaction Data from providers of technical, or payment services;
(b) Identity and Contact Data from data brokers or aggregators, Including specialist databases used to comply with our legal and regulatory obligations under applicable anti money laundering and counterterrorism laws, trade organizations or exhibition organizers; and
(c) Identity and Contact Data from publicly available sources.
The categories of personal data that the Company processes about its clients are set out in Annex 1 to this Notice, which also identifies the lawful basis for the processing, including where the processing is for the Company’s pursuit of its legitimate business interests.
The data in which the Company processes may include Sensitive Personal Data, as defined under applicable laws, and to the extent allowed therein. Such Sensitive Personal Data may include data about:
(a) Race or ethnicity or religious beliefs (where relevant to the Services); or
(b) Health or illness.
Your data maybe sourced in multiple ways, including, but not limited to: from you or representatives authorized to provide such information on your behalf; information made available in the public domain (e.g., websites, social media, news articles, public statements, interviews, etc.); and through business dealings with third parties.
The Company may disclose your personal data to certain third parties. The following is a non-exhaustive list of recipients to whom your personal data may be transferred:
1. Subsidiaries, affiliates and parent companies of the Company;
2. Service providers;
3. Regulatory authorities;
4. Third party intermediaries;
5. Legal and other professional advisors; and
6. Prospective purchasers of the Company or Company assets.
The Company is a member of the Summit Group. As a result, we may share your personal data with other companies in the Summit Group as well as with external third parties in order to provide our Services and otherwise in connection with the running of our business, including to enable us to comply with our legal obligations.
Where we share your personal data with selected service providers and/or third party intermediaries who are engaged by us to assist us to provide our Services or with the running of our business, we ensure that these service providers and/or third party intermediaries are bound by law and/or contract to protect the confidentiality and security of personal data and to only use the personal data to provide the requested services to us and in accordance with applicable law.
Some of the companies in our group are located outside of the UAE, the ADGM and/or the KSA in territories that do not have the same level of protection for personal data as within the UAE, the ADGM and/or the KSA, and some of our external service providers may process your personal data outside of the UAE, the ADGM and/or the KSA. If and when transferring your personal data outside the UAE, the ADGM and/or the KSA, we will only do so when we have an appropriate mechanism or safeguard in place, including:
a) the transfer is to a country that has been the subject of an adequacy decision by the European Commission, the UAE Data Office, the ADGM Office of Data Protection and/or the Saudi Data & AI Authority (as may be applicable);
b) in relation to the KSA, we may transfer data outside the KSA subject to appropriate safeguards being in place (provided the regulatory requirements in the relevant country do not prejudice your privacy or our ability to enforce appropriate safeguards). This may comprise (i) binding common rules, (ii)standard contractual clauses (in accordance with a standard form to be issued by the competent authority in the KSA), (iii) certifications of compliance or(iv) binding codes of conduct; or
c) the transfer is covered by a contractual agreement[SPB1] , which covers the applicable law requirements relating to transfers to countries outside the UAE, the ADGM, the KSA and/or the EEA (e.g., ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses or if the service provider is in the US, it has self-certified to the EU/US Privacy Shield Framework).
These transfers of your personal data may be made subject to the above-mentioned safeguards, and/or where the transfer is occasional and necessary for the performance of a contract or the implementation of pre-contractual measures between you and the Company. Additionally, where it is in your interests, we may also transfer data belonging to you that is necessary for the performance/conclusion of a contract between the Company and a third party.
The Company may choose to sell, transfer, or merge parts of its business, or its assets or Company may seek to acquire other businesses or merge with them. During any such process, the Company may share your data with other parties. The Company will only do this if they agree to keep your data safe and private.
You have the following rights:
a) to obtain access to your personal data – you may request information on how your personal data is handled by us and request a copy of such personal data;
b) to request that we correct or update your personal data if it is inaccurate or out of date;
c) to object to the processing of your personal data for the purposes of our legitimate interests, unless we:
i. demonstrate compelling legitimate grounds which override your right to object; or
ii. the processing is necessary for the establishment, exercise or defense of legal claims;
d) to ask us to erase your personal data held by us, for example:
i. which is no longer necessary in relation to the purposes for which it was collected;
ii. to the processing of which you object; or
iii. which may have been unlawfully processed by us;
e) to ask us to this restrict processing by us, for example:
i. where you would like us to verify the accuracy of the data; or
ii. where you object to the processing of it by us on the basis of legitimate interests (see para 7c above) pending verification of whether we have overriding legitimate grounds to process the data; and
f) to ask us to transmit personal data, you submitted to us back to you or to another organization in certain circumstances.
The right to erasure and to restrict processing listed above may not apply or may be limited in certain circumstances, such as where the processing is necessary for compliance with our legal obligations or the establishment, exercise or defense of legal claims.
Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, but this will not affect the lawfulness of processing based on your consent prior to withdrawal.
These rights are not absolute and may be subject to certain conditions under the GDPR, UAE DPL, ADGM DPR and/or the PDPL (as may be applicable). Should you wish to exercise any of these rights, please contact Company using the details in Section 11.
The Company will keep and process your personal data only for as long as is necessary for the purposes for which it was collected in connection with the Services, unless the Company has a legal right or obligation to retain the data for a longer period, or in order to establish, exercise, or defend potential legal claims.
We do not envisage that any decisions will be taken about you using solely automated means. We will notify you if this changes.
We strive to process your personal data in accordance with the applicable legal obligations but if you have any complaint(s) in that regard, please address your complaint(s) using the contact details set out in Section 11.
You also have the right to lodge a complaint with a supervisory authority for data protection in your jurisdiction. We ask that if you are not happy with how we handle your personal data that you reach out to us in the first instance so that we can try to provide you with a satisfactory resolution to your request.
If you have any questions about this Notice or information we hold about you, please email us on ask@sanctuary.ae, or write to us below.
· Sanctuary Corporate Services FZ LLC
Suite 902, 9th floor
Control Tower
Motor City
Dubai, UAE
· Sanctuary Business Services LLC
Riyadh
Office 16, Floor 5
Samama Tower
King Fahd Road
Al Olaya, Riyadh, Saudi Arabia
We may update this Notice periodically. Where the changes made are material, we will inform you of these.
Annex 1: Categories of Personal Data and Grounds for Processing
The Company will process the following categories of personal databased on specified lawful bases for processing under the GDPR, UAE DPL, ADGMDPR and/or the PDPL as may be applicable. Key examples of data and the legal bases for processing are set out below:
1 Personal data necessary for the performance of the agreement with the Company for the Services:
a) Contact Details
a. Name;
b. Personal Contact details (personal email address, phone numbers, physical address, etc.);
c. Contact details of managers, legal and professional advisors; and
d. Travel Information (e.g., passports, etc.).
b) Government-issued KYC documents / Due diligence
i. Passports;
ii. Certificate of incorporation;
iii. Banking Details, including bank statements, name of banking institution(s), and account and/or routing numbers for deposits or electronic transfers (i.e. wire transfer);
iv. Property title deeds; and
v. Wills.
c) Tax records and any other tax related documentation necessary for the performance of the Services (e.g., VAT Number).
d) Transaction Data including details about services you have purchased from us or your visits to our premises.
e) Profile Data including your username and password, purchases or orders made by you, your interests, preferences (including details about your personal likes and dislikes as identified during your visits to our premises), feedback and survey responses.
f) Usage Data including information about how you use our website, products and services.
g) Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
2 Personal Data necessary to comply with Company’s legal obligations
Some examples legal obligations include:
· Record-keeping and reporting obligations;
· Conducting audits, compliance with government inspections and other requests from government or other public authorities; and
· Responding to legal processes, pursuing legal rights and remedies, defending litigation, managing any internal complaints or claims, and conducting investigations(e.g., processing personal data in response to a court order).
The categories of personal data collected may include:
· Records of payments received and/or disbursed to you;
· Tax records;
· Contracts, deal memos, or other agreements; and
· Contact details.
Personal Data processed where necessary for the purposes of pursuing the legitimate interests of the Company or a third party.
Personal data will only be processed with regard to pursuing legitimate interests of the Company or a third party where appropriate and where such legitimate interest is not overridden by your rights and freedoms.
Some examples of the Company’s legitimate interests include:
· Mergers and acquisitions with other companies;
· Dealings with prospective purchasers of the Company or its assets;
· Improvement of the services provided to our clients, invoicing for our services or dealing with complaints;
· To pursue or defend against legal claims; and
· Business dealings with subsidiaries, affiliates, and parent companies of the Company.
3 Processing of Special Categories of Personal Data
As mentioned in Section 5 of the Notice above, we may process certain personal data which are considered to be Sensitive Personal Data under the GDPR, UAE DPL, ADGM DPR and/or the PDPL. The categories of data include:
(a) Race or ethnicity or religious beliefs (where relevant to the Services); and
(b) Health or illness.
Annex 2 – Legal Entities
· DLK HOLDINGS LIMITED
3520ResCo-work04,
35, Al Maqam Tower, Adgm Square,
Al Maryah Island,
Abu Dhabi, UAE
· ELEMENTS GROUP LIMITED
C/o SANCTUARY CORPORATE SERVICES FZ LLC - DUBAI BRANCH
Suite 902, 9th floor,
Control Tower
Motor City
Dubai, UAE
· ELEMENTS YELLOW LIMITED
80 Main Street,
PO Box 3200,
Road Town, Tortola,
VG1110, British Virgin Islands
· ELEMENTS BLUE LIMITED
80 Main Street,
PO Box 3200,
Road Town, Tortola,
VG1110, British Virgin Islands
· ELEMENTS GREEN LIMITED
80 Main Street,
PO Box 3200,
Road Town, Tortola,
VG1110, British Virgin Islands
· ELEMENTS RED LIMITED
80 Main Street,
PO Box 3200,
Road Town, Tortola,
VG1110, British Virgin Islands
· ALDERLEY GLOBAL LLC
Sharjah Media City,
Sharjah, UAE
· ALDERLEY GLOBAL LLC - DUBAI BRANCH
Office 1715,
The Binary By Omniyat
Business Bay
Dubai, UAE
· SANCTUARY CORPORATE SERVICES FZ LLC
Fujairah-Creative Tower
P.O. Box 4422 Fujairah
· SANCTUARY CORPORATE SERVICES FZ LLC - DUBAI BRANCH
Suite 902, 9th floor
Control Tower
Motor City
Dubai, UAE
· SANCTUARY CORPORATE SERVICES FZ LLC - ADGM BRANCH
3520ResCo-work04,
35, Al Maqam Tower, Adgm Square,
Al Maryah Island,
Abu Dhabi, UAE
· SANCTUARY BUSINESS SERVICES LLC
Riyadh
Office 16, Floor 5
Samama Tower
King Fahd Road
Al Olaya, Riyadh, Saudi Arabia
· SANCTUARYHOLDINGS LIMITED
3520ResCo-work04,
35, Al Maqam Tower, Adgm Square,
Al Maryah Island,
Abu Dhabi, UAE
· SANCTUARYHOLDCO LTD
3520ResCo-work04,
35, Al Maqam Tower, Adgm Square,
Al Maryah Island,
Abu Dhabi, UAE
