Finneva Financial Services (DIFC) Limited

Privacy Policy Statement

Client and Prospective Client Privacy Notice

1. About this Notice

Protecting the confidentiality, integrity and security of Personal Data is integral to the way Finneva Financial Services (DIFC) Limited (“FFSL”, “we”, “our” or “us”) conducts business. This Privacy Policy Statement explains how FFSL collects, uses, shares, stores and protects Personal Data and describes the rights available to Data Subjects under the DIFC Data Protection Law, DIFC Law No. 5 of 2020, as amended (the “Law”), and the Data Protection Regulations (together, the “DIFC Data Protection Legislation”).

FFSL is the Controller of the Personal Data described in this notice where it determines why and how the information is Processed. This notice applies to clients, prospective clients, investors and, where relevant, their directors, officers, authorised representatives, beneficial owners, controllers, settlors, trustees, beneficiaries, employees and connected persons.

2. Controller and Contact Details

Finneva Financial Services (DIFC) Limited
Unit 410, Level 4, Liberty House, DIFC, PO Box 34469, Dubai, UAE
Email: vikas.jha@finneva.ae
Direct Mobile No: +971 50 869 9625
General Office No: +971 4 323 1861
Data Protection Contact / Privacy Lead: Mr. Vikas Jha

3. Personal Data We Collect

Depending on the relationship and services requested, FFSL may collect and Process the following categories of Personal Data:

FFSL will seek to limit collection to information that is adequate, relevant and reasonably necessary for the stated purposes. If Personal Data about another individual is provided to us, the person providing it should ensure that the individual is authorised to receive this notice or is otherwise informed of the Processing, where required.

4. How We Obtain Personal Data

FFSL may obtain Personal Data:

• Directly from you through applications, agreements, instructions, meetings, calls, correspondence and service interactions;
• From your authorised representatives, family members, advisers, introducers or other persons acting on your behalf;
• From banks, custodians, brokers, fund managers, administrators, insurers and other financial institutions;
• From Group entities and professional or technology service providers;
• From public registers, company registries, court records, websites, media reports and other publicly available sources;
• From sanctions, PEP, adverse-media, fraud-prevention, identity-verification and screening providers; and
• From regulators, tax authorities, law-enforcement bodies and other public authorities, where lawful.

Where FFSL obtains Personal Data from a source other than the Data Subject, FFSL will provide the information required by the Law within the applicable statutory period—generally within one month, at the time of first communication or before the first disclosure, as applicable—unless a lawful exception applies.

5. Purposes and Lawful Bases

FFSL Processes Personal Data only where it has identified and documented a lawful basis. The principal purposes and bases are set out below. More than one basis may apply to a particular activity.

6. Special Categories and Criminal-Offence-Related Data

FFSL may incidentally or necessarily Process Special Categories of Personal Data or criminal-offence-related information through sanctions and PEP screening, adverse-media reviews, identity verification, fraud prevention, legal claims or information voluntarily supplied in connection with a client relationship. Such information is Processed only where FFSL has an Article 10 lawful basis and a separate condition under Article 12 of the Law, or another specific legal authority, and applies enhanced access, confidentiality, retention and security controls.

FFSL does not seek Special Categories of Personal Data where they are unnecessary. Data Subjects should avoid providing such information unless requested or relevant to the services or legal and regulatory obligations.

7. Legitimate Interests

Where FFSL relies on legitimate interests, it assesses the purpose, necessity and impact of the Processing and balances its interests against the Data Subject’s rights and reasonable expectations. Examples include relationship administration, service improvement, network and information security, fraud prevention, risk management, call recording, internal reporting and the establishment, exercise or defence of legal claims.

A Data Subject may object to legitimate-interest Processing. FFSL will stop the Processing unless it demonstrates compelling legitimate grounds that override the Data Subject’s interests, rights and freedoms, or the Processing is required for the establishment, exercise or defence of legal claims.

8. Consent and Direct Marketing

Where consent is relied upon, it must be freely given, specific, informed and unambiguous. Consent may be withdrawn at any time, without affecting the lawfulness of Processing carried out before withdrawal.

FFSL will send direct electronic marketing only where legally permitted. A Data Subject may withdraw marketing consent or object to direct marketing at any time and free of charge by using the unsubscribe facility in the communication or contacting FFSL. FFSL will honour the request promptly and may retain limited suppression information solely to prevent further marketing.

9. Who We Share Personal Data With

FFSL may disclose Personal Data, on a need-to-know and lawful basis, to:

• Banks, custodians, brokers, exchanges, fund managers, fund administrators, trustees and other product or service providers;
• Group entities and affiliates supporting the relationship or shared operations;
• Auditors, lawyers, accountants, tax advisers, consultants, insurers and other professional advisers;
• IT, cloud, communications, cybersecurity, archiving, screening, identity-verification and other service providers;
• Introducers and authorised representatives where the disclosure is authorised and appropriate;
• The DFSA, DIFC authorities, tax authorities, courts, law-enforcement agencies and other regulators or public authorities;
• Prospective purchasers, transferees or counterparties in a proposed corporate transaction, subject to appropriate safeguards; and
• Other recipients where the Data Subject has authorised disclosure or where disclosure is otherwise required or permitted by law.

Processors acting for FFSL must be subject to written contractual obligations addressing confidentiality, security, instructions, Sub-processors, assistance, deletion/return and audit rights. Certain recipients act as independent Controllers and are responsible for their own Processing.

10. Transfers Outside the DIFC

Personal Data may be transferred to, stored in or accessed from jurisdictions outside the DIFC, including by FFSL’s Group entities, financial counterparties and service providers. Some jurisdictions may not provide protections equivalent to those in the DIFC.

Before making a transfer, FFSL will ensure that it is permitted under the Law. This may be because the jurisdiction has been recognised as providing an adequate level of protection; FFSL has implemented appropriate safeguards under Article 27; or a specific statutory derogation applies and its conditions are satisfied. Appropriate safeguards may include approved standard data-protection clauses, binding corporate rules, legally binding instruments, approved codes or certification mechanisms, or another mechanism recognised under the Law.

FFSL assesses the transfer, recipient, destination, onward-transfer risk and supplementary safeguards where appropriate. A Data Subject may contact FFSL for further information about the applicable transfer mechanism and, where available, to request a copy of the relevant safeguards, subject to lawful confidentiality restrictions.

11. Retention and Disposal

FFSL retains Personal Data only for as long as reasonably necessary for the purposes described in this notice and to satisfy applicable legal and regulatory requirements. Retention periods are determined by the nature of the record, the client relationship, DIFC and DFSA record-keeping obligations, AML/CFT and tax requirements, limitation periods, actual or anticipated disputes, investigations and legal holds.

Client and transaction records will ordinarily be retained for the minimum period required by Applicable Law after the relationship or relevant transaction ends and may be kept longer where a legal, regulatory, contractual or litigation requirement applies. At the end of the approved period, information will be securely erased, anonymised or destroyed in accordance with FFSL’s retention and disposal controls.

12. Security

FFSL implements risk-appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include, where appropriate, role-based access, least privilege, confidentiality obligations, authentication, encryption, secure configuration, logging and monitoring, backups, incident response, physical security, vendor controls and periodic testing.

No transmission or storage method is completely secure. FFSL nevertheless maintains proportionate safeguards and requires personnel and relevant service providers to report suspected security incidents promptly.

13. Data Subject Rights

Subject to the conditions and exceptions in the Law, a Data Subject may have the right to:

• Receive information about FFSL’s Processing and obtain access to Personal Data;
• Request correction of inaccurate data and completion of incomplete data;
• Request erasure of Personal Data in qualifying circumstances;
• Request restriction of Processing;
• Receive qualifying Personal Data in a structured, commonly used and machine-readable format and request transmission where applicable;
• Object to Processing based on legitimate interests and object at any time to direct marketing;
• Withdraw consent at any time where Processing is based on consent;
• Request applicable safeguards concerning solely automated decisions with legal or similarly significant effects; and
• Lodge a complaint with the DIFC Commissioner of Data Protection.

FFSL may request information reasonably necessary to verify identity and authority. FFSL will respond without undue delay and ordinarily within one month, subject to any lawful extension for complex or numerous requests. Rights may be restricted where permitted by the Law, including to protect the rights of others or comply with legal and regulatory obligations.

14. Automated Decision-Making and Online Activity

FFSL does not currently use Personal Data to make decisions based solely on automated Processing, including profiling, that produce legal or similarly significant effects. If this changes, FFSL will assess the Processing, provide required information and implement applicable safeguards, including appropriate human intervention and the ability to contest the decision.

FFSL does not sell or rent Personal Data. FFSL does not currently track Data Subjects’ online activities across unrelated websites. Any cookies or similar technologies used on an FFSL website will be addressed through an appropriate cookie notice or consent mechanism where required.

15. If Personal Data Is Not Provided

Certain Personal Data is required to onboard a client, enter into or perform a contract, provide services and comply with legal, tax, AML/CFT, sanctions and regulatory obligations. If required information is not provided, FFSL may be unable to onboard the person, provide or continue the requested services, process an instruction or maintain the business relationship, subject to Applicable Law and contractual requirements.

16. Complaints and Exercising Rights

Requests, objections, consent withdrawals and privacy complaints may be submitted to:

A Data Subject may also lodge a complaint with the DIFC Commissioner of Data Protection. Current contact and complaint information is available at: https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection

17. Changes to this Notice

FFSL may amend this notice to reflect changes in law, regulatory guidance, services, technology or Processing activities. Material changes will be communicated through an appropriate channel, such as direct notification, contractual communication or publication on FFSL’s website. The effective date and version shown at the top of this notice identify the current notice.

18. Interpretation

Capitalised terms used in this notice, including “Controller”, “Data Subject”, “Personal Data”, “Process/Processing”, “Processor” and “Special Categories of Personal Data”, have the meanings given in the DIFC Data Protection Legislation. If this notice conflicts with a mandatory requirement of the Law or Regulations, that mandatory requirement prevails.