PRIVACY POLICY
BINGHATTI CAPITAL LIMITED
Effective Date: 9 June 2026
CONTENTS
1. Important information and who we are
2. The types of personal data we collect about you
3. How is your personal data collected?
4. How we use your personal data
5. Disclosures of your personal data
6. International transfers
7. Data security
8. Data retention
9. Your legal rights
10. Contact details
11. Complaints
12. Changes to the privacy policy and your duty to inform us of changes
13. Third-party links
Introduction
This privacy policy sets out how Binghatti Capital Limited uses and protects your personal data.
1. Important information and who we are
Privacy policy
This privacy policy gives you information about how Binghatti Capital Limited collects and uses your personal data through your use of the website accessible at www.binghatticapital.com (the "Website"), including the investor portal accessible to registered users of the Website (the "Investor Portal"), and any data you may provide when you register with us, apply for our products or services, or otherwise interact with us.
This Website is directed to, and intended for use by, Professional Clients as defined under the Rulebook of the Dubai Financial Services Authority ("DFSA"). General informational content on the Website may be accessed by other persons, but no person who is not a Professional Client should rely on, or act upon, any content on this Website that relates to financial services, investment products, fund performance, or any other regulated activity. Binghatti Capital does not deal with retail clients.
This Website is not intended for children and we do not knowingly collect data relating to children.
Controller
Binghatti Capital Limited is the controller and responsible for your personal data (referred to as "Binghatti Capital", "we", "us" or "our" in this privacy policy).
Binghatti Capital Limited is a company incorporated in the Dubai International Financial Centre ("DIFC") and is authorised and regulated by the DFSA under Reference Number F010521. Binghatti Capital is permitted to carry on the following regulated financial services in accordance with its DFSA licence:
- (a)Managing a Collective Investment Fund;
- (b)Advising on Financial Products;
- (c)Arranging Deals in Investments; and
- (d)Managing Assets,
with endorsement to Hold or Control Client Assets and to Operate an Islamic Window.
We have appointed a Data Protection Officer ("DPO") who is responsible for overseeing questions in relation to this privacy policy in accordance with Articles 16, 17 and 18 of DIFC Data Protection Law No. 5 of 2020 (as amended) (the "Data Protection Law"). If you have any questions about this privacy policy, including any requests to exercise your legal rights (paragraph 9), please contact the DPO using the information set out in the contact details section (paragraph 10).
2. The types of personal data we collect about you
Personal data means any information referring to an identified or identifiable natural person, as defined in the Data Protection Law.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
• Identity Data includes first name, last name, any previous names, username or similar identifier, marital status, title, date of birth, gender, nationality, place of birth, passport details and photographs.
• Contact Data includes residential and correspondence address, email address and telephone numbers.
• Financial Data includes bank account details and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us, including capital calls, distributions, subscription amounts and redemption proceeds.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device identifiers and other technology on the devices you use to access the Website.
• Profile Data includes your username and login credentials which we protect using appropriate technical and organisational security measures, investments or subscriptions made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you interact with and use the Website (including the Investor Portal), our products and services.
• Marketing and Communications Data includes your preferences in receiving communications from us and your communication preferences.
• KYC and Regulatory Data includes information collected as part of our know-your-customer, anti-money laundering and counter-terrorist financing checks, including source-of-funds and source-of-wealth documentation, politically exposed person screening results, and sanctions screening results.
Certain categories of personal data are classified as "Special Categories of Personal Data" under the Data Protection Law and attract additional protections. In the course of our KYC, AML and CTF onboarding procedures, we may process the following Special Categories of Personal Data:
• Biometric data, where our identity verification service providers use such data for the purpose of uniquely identifying you (for example, through facial recognition or fingerprint matching). We only process biometric data in this way where our onboarding procedures require it.
• Certain documents provided during onboarding (such as identity documents or source-of-funds documentation) may incidentally contain information that reveals or concerns racial or ethnic origin or religious beliefs. We do not request such information unless required by applicable law.
We process Special Categories of Personal Data only where one or more of the following conditions under Article 11 of the Data Protection Law applies:
- (a)the processing is necessary to comply with applicable anti-money laundering or counter-terrorist financing obligations (Article 11(h));
- (b)the processing is necessary for compliance with a specific requirement of applicable law to which we are subject, including regulatory obligations imposed by the DFSA Rulebook (Article 11(g));
- (c)you have given explicit consent to the processing of those Special Categories of Personal Data for one or more specified purposes (Article 11(a)); or
- (d)the processing relates to personal data that has been made public by you (Article 11(e)).
We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) identify you. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific Website feature in order to analyse general trends in how users are interacting with the Website to help improve the Website and our service offering.
3. How is your personal data collected?
We use different methods to collect data from and about you including through:
Your interactions with us. You may give us your personal data by filling in online forms, submitting applications, entering into subscription agreements or other fund documentation, or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
• apply for our products or services;
• register for access to the Investor Portal;
• subscribe to or invest in a fund managed by Binghatti Capital;
• submit know-your-customer or onboarding documentation;
• request information to be sent to you;
• enter into any agreement with us;
• give us feedback or contact us; or
• submit a complaint.
Automated technologies or interactions. As you interact with the Website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookie Policy [COOKIE POLICY URL] for further details.
Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
• Technical Data from analytics providers.
• Identity, Contact and KYC and Regulatory Data from identity verification, credit reference and screening providers.
• Identity and Contact Data from publicly available sources, including corporate registries and regulatory databases.
• Financial and Transaction Data from fund administrators, custodians, transfer agents and payment service providers.
• Identity, Contact and Financial Data from your professional advisers (such as lawyers and accountants) where they act on your behalf in connection with your investment.
4. How we use your personal data
Legal basis
The Data Protection Law requires us to have a lawful basis for processing your personal data. In accordance with Article 10 of the Data Protection Law, we rely on one or more of the following lawful bases:
• Performance of a contract with you: Where processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into such contract (Article 10(b)).
• Legitimate interests: Where processing is necessary for the purpose of legitimate interests pursued by us or a third party to whom the personal data has been made available, subject to Article 13, except where such interests are overridden by your interests or rights (Article 10(f)). We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests.
• Legal or regulatory obligation: Where processing is necessary for compliance with applicable law to which we are subject, including obligations under the DFSA Rulebook, DIFC anti-money laundering legislation and the Data Protection Law itself (Article 10(c)).
• Consent: Where you have given consent, which complies with Article 12, to the processing of your personal data for specific purposes (Article 10(a)). You have the right to withdraw consent at any time in accordance with Article 32 (see paragraph 9).
• Vital interests: In limited circumstances, where processing is necessary in order to protect your vital interests or those of another natural person (Article 10(d)).
Purposes for which we will use your personal data
We have set out below a description of the ways we use the various categories of your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
| Purpose / Use | Type of data | Lawful basis |
|---|
| To register you as a client and conduct onboarding (including KYC, AML and CTF checks) | (a) Identity
(b) Contact
(c) Financial
(d) KYC and Regulatory | (a) Performance of a contract with you (Article 10(b))
(b) Compliance with applicable law (Article 10(c)), including the DFSA Rulebook and DIFC AML legislation |
| To process and manage your investment, including managing subscriptions, redemptions, capital calls, distributions, payments, fees and charges | (a) Identity
(b) Contact
(c) Financial
(d) Transaction | (a) Performance of a contract with you (Article 10(b))
(b) Legitimate interests (Article 10(f)): to recover debts due to us |
| To provide you with access to the Investor Portal and display information relating to your investments | (a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) Technical
(f) Profile | (a) Performance of a contract with you (Article 10(b))
(b) Legitimate interests (Article 10(f)): to provide investors with convenient access to investment information |
| To manage our relationship with you, including notifying you about changes to our terms, privacy policy or fund documentation, and dealing with your requests, complaints and queries | (a) Identity
(b) Contact
(c) Profile
(d) Marketing and Communications | (a) Performance of a contract with you (Article 10(b))
(b) Compliance with applicable law (Article 10(c))
(c) Legitimate interests (Article 10(f)): to keep our records updated and manage our relationship with you |
| To administer and protect our business and the Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | (a) Identity
(b) Contact
(c) Technical | (a) Legitimate interests (Article 10(f)): for running our business, provision of administration and IT services, network security, to prevent fraud
(b) Compliance with applicable law (Article 10(c)) |
| To comply with legal and regulatory obligations, including reporting to the DFSA, responding to regulatory enquiries, and maintaining records | (a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) KYC and Regulatory | Compliance with applicable law (Article 10(c)) |
| To use data analytics to improve the Website, our products, services, client relationships and experiences | (a) Technical
(b) Usage | Legitimate interests (Article 10(f)): to keep the Website updated and relevant, to develop our business and to inform our strategy |
| To detect, prevent and investigate fraud, money laundering, terrorist financing and other financial crime | (a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) KYC and Regulatory
(f) Technical | (a) Compliance with applicable law (Article 10(c))
(b) Legitimate interests (Article 10(f)): to protect our business and clients from financial crime (see also Article 13(3)) |
Retention periods
We set out our data retention periods in paragraph 8 below.
Marketing communications
Binghatti Capital does not currently conduct direct marketing. Should this position change in the future, we will update this privacy policy accordingly and, where required, obtain your consent before sending you any direct marketing communications.
You will continue to receive service-related communications that are essential for administrative, regulatory or client-service purposes (for example, capital call notices, distribution notices, regulatory notifications and changes to our terms). These are not marketing communications.
Cookies
We use a small number of cookies on our Website, including the Investor Portal. This section explains what cookies we use, why we use them, and how you can manage your preferences.
What are cookies?
Cookies are small text files placed on your device when you visit a website. They are retrieved on subsequent visits and allow the website to recognise your device and remember certain information about your session or preferences.
Cookies we use
The table below sets out the cookies currently in use on the Website. We will update this section whenever our use of cookies changes.
Cookie name: _ga, _ga_[ID]
Provider: Google LLC
Category: Analytics
Purpose: Measures and reports on how visitors interact with the Website in aggregate, enabling us to improve its content and performance.
Lawful basis: Legitimate interests (Article 10(f)) — to keep the Website relevant and to develop our business.
Retention: Up to 2 years.
Cookie name: _gcl_au
Provider: Google LLC (via Google Tag Manager)
Category: Analytics
Purpose: Supports conversion tracking and facilitates the loading of analytics tags across the Website.
Lawful basis: Legitimate interests (Article 10(f)).
Retention: 90 days.
Cookie name: Session cookie (e.g. session_token or equivalent)
Provider: Binghatti Capital Limited
Category: Strictly necessary
Purpose: Maintains your authenticated session when you log in to the Investor Portal. Without this cookie the portal cannot function.
Lawful basis: Performance of a contract with you (Article 10(b)). This cookie does not require your consent.
Retention: Session only — deleted automatically when you log out or close your browser.
Please note: although session cookies are deleted when you close your browser or log out, server-side access logs recording your Investor Portal activity are retained separately in accordance with our data retention policy at paragraph 8.
Third-party cookie providers
Where we use third-party services, those providers may process cookie-collected data in accordance with their own privacy policies. Google's privacy policy is available at https://policies.google.com/privacy.
Managing your cookie preferences
Most browsers accept cookies by default. You can control or delete cookies through your browser's 'Help' or 'Settings' menu. You may also visit www.aboutcookies.org for independent guidance on managing and deleting cookies across different browsers and devices. For mobile devices, please refer to your handset manual or network operator.
Please be aware that disabling certain cookies may limit your ability to access parts of the Website, including the Investor Portal.
5. Disclosures of your personal data
We may share your personal data where necessary with the parties set out below for the purposes set out in the table in paragraph 4 above:
- (a)Internal third parties: Other entities within the Binghatti group of companies, where applicable, who may provide IT, system administration, compliance and reporting services and who are subject to appropriate data protection obligations. A controller that is part of a group may have a legitimate interest in transferring personal data within its group for internal administrative purposes (Article 13(2)).
- (b)External third parties, including:
• Fund administrators, custodians, transfer agents, auditors and other service providers appointed in connection with the funds managed by Binghatti Capital.
• Professional advisers, including lawyers, accountants, bankers and insurers, who provide consultancy, legal, banking, insurance and accounting services.
• Identity verification, credit reference and screening providers for the purposes of KYC, AML and CTF compliance.
• IT service providers, cloud hosting providers and data analytics providers.
• The DFSA and other regulatory authorities, government entities and law enforcement agencies, where required by applicable law, regulation or legal process, subject to the data sharing requirements of Article 28.
• The Sharia Supervisory Board appointed in respect of any fund operated through Binghatti Capital's Islamic Window, to the extent necessary for Sharia governance and review.
- (c)Corporate transactions: Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Where processing is carried out on our behalf by a processor, the processing is governed by a legally binding written agreement in accordance with Article 24 of the Data Protection Law.
6. International transfers
The DIFC is a separate legal jurisdiction within the United Arab Emirates. Under the Data Protection Law, a transfer of personal data from the DIFC to any jurisdiction outside the DIFC — including to the UAE mainland — constitutes a transfer to a "Third Country" as defined in Schedule 1 of the Data Protection Law.
Transfers to the UAE mainland. In the course of our business operations, we transfer personal data from the DIFC to recipients located in the UAE mainland. This is our primary cross-jurisdictional transfer. As the UAE mainland has not, at the date of this policy, been the subject of a formal adequacy determination by the Commissioner of Data Protection under Article 26(2) of the Data Protection Law, we ensure that such transfers are protected by appropriate safeguards in accordance with Article 27 of the Data Protection Law, including:
• standard data protection clauses adopted or approved by the Commissioner of Data Protection in accordance with Article 27(2)(c); and
• where applicable, reliance on the specific derogations set out in Article 27(3), including where the transfer is necessary for the performance of a contract between us and you (Article 27(3)(b)), for the establishment, exercise or defence of a legal claim (Article 27(3)(f)), or for compliance with applicable anti-money laundering or counter-terrorist financing obligations (Article 27(3)(k)).
Other transfers. Where we transfer your personal data outside the DIFC to any other Third Country, we ensure that a similar degree of protection is afforded to it by implementing one or more of the following safeguards:
• We will only transfer your personal data to a Third Country that has been determined by the Commissioner of Data Protection to provide an adequate level of protection for personal data under Article 26(2) or Article 26(3).
• We may use standard data protection clauses adopted or approved by the Commissioner of Data Protection under Article 27(2)(c).
• We may rely on binding corporate rules approved in accordance with Article 27(2)(b) and Article 27(7), where applicable.
• We may rely on any other appropriate safeguard or derogation permitted under Articles 26 or 27 of the Data Protection Law.
Where required, we assess the circumstances of a transfer and implement appropriate safeguards to ensure that enforceable data subject rights and effective legal remedies are available, in accordance with Articles 26 and 27 of the Data Protection Law.
To obtain further details of the safeguards we have in place in respect of international transfers of your personal data, please contact us using the details set out in paragraph 10.
7. Data security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed, in accordance with Article 14(2) of the Data Protection Law. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality in accordance with Article 25 of the Data Protection Law.
When accessing Binghatti Capital's services, you may be required to go through a verification and authorisation process to confirm your identity through our know-your-customer procedures.
We have put in place procedures to deal with any suspected personal data breach and will notify the Commissioner of Data Protection and, where applicable, affected data subjects of a breach where we are legally required to do so in accordance with Articles 41 and 42 of the Data Protection Law.
8. Data retention
How long will we use your personal data for?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements, in accordance with Article 9(1)(i) of the Data Protection Law. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Our standard retention periods are as follows:
| Category of data | Retention period |
|---|
| Corporate, financial and transaction records (including Contact, Identity, Financial and Transaction Data) | A minimum of six (6) years from the end of the client relationship, in accordance with record-keeping obligations under the DFSA Rulebook |
| KYC, AML and CTF onboarding records (including KYC and Regulatory Data, and associated Identity and Contact Data) | A minimum of five (5) years from the date of termination of the business relationship, in accordance with DIFC anti-money laundering legislation |
| Technical and Usage Data | Retained for the duration of your use of the Website and for a period of two (2) years thereafter, unless a longer period is required for the purposes of any investigation or legal proceedings |
| Investor Portal access logs | A minimum of six (6) years from the date of the relevant access event |
In some circumstances you can ask us to delete your data: see paragraph 9 below for further information. Where we are required to cease processing and no lawful basis for retention applies, we will comply with Article 22 of the Data Protection Law.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
9. Your legal rights
Under Part 6 of the Data Protection Law, you have a number of rights in relation to your personal data. You have the right to:
- (a)Request access to your personal data. Upon request, you have the right to obtain from us, without charge and within one (1) month, confirmation as to whether or not personal data relating to you is being processed, information as to the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data are disclosed, and a copy of the personal data undergoing processing (Article 33(1)).
- (b)Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us (Article 33(1)(c)).
- (c)Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where, for example, the processing is no longer necessary in relation to the purposes for which it was collected, you have withdrawn consent and there is no other lawful basis for processing, or the processing is unlawful. Note, however, that we may not always be able to comply with your request for erasure where we are required to retain the personal data in compliance with applicable law or for the establishment or defence of legal claims (Article 33(2) and Article 33(3)).
- (d)Object to processing of your personal data where we are relying on legitimate interests (Article 10(f)) as the lawful basis for that particular use of your data. In some cases, we may demonstrate that we have compelling legitimate grounds to continue processing your information which override your right to object. Where an objection is justified, we shall cease processing and comply with Article 22 of the Data Protection Law (Article 34).
- (e)Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in certain scenarios, for example if you want us to establish the data's accuracy, where our use of the data is unlawful but you do not want us to erase it, where you need us to hold the data for the establishment, exercise or defence of legal claims, or where you have objected to our use of your data pending verification of whether our legitimate grounds override yours (Article 35).
- (f)Request the portability of your personal data. You have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format where the processing is based on your consent or the performance of a contract and is carried out by automated means. Where technically feasible, you have the right to have the personal data transmitted directly to another controller (Article 37).
- (g)Withdraw consent at any time where we are relying on consent (Article 10(a)) to process your personal data. Withdrawal of consent does not affect the lawfulness of any processing carried out before the date of withdrawal. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. Upon withdrawal of consent, we will cease processing your personal data as soon as reasonably practicable and comply with Article 22 of the Data Protection Law (Article 32).
- (h)Rights in relation to automated decision-making. We do not currently make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you. Should that position change, we will update this policy and implement the safeguards required by Article 38 of the Data Protection Law, including your right to object to such decisions and to require that they be reviewed manually.
- (i)Non-discrimination. We will not discriminate against you for exercising any of your rights under Part 6 of the Data Protection Law (Article 39).
How to exercise your rights
In accordance with Article 40 of the Data Protection Law, we make available at least two methods by which you can contact us to exercise your rights. If you wish to exercise any of the rights set out above, please contact us using the details set out in paragraph 10.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs, or refuse to act on the request, in accordance with Article 33(8).
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it (Article 33(12)). We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We endeavour to respond to all legitimate requests within one (1) month. If your request is particularly complex, we may extend the period for compliance by a further two (2) months, and we will notify you of the reasons for the delay within the initial one-month period (Article 33(7)).
10. Contact details
If you have any questions about this privacy policy or about the use of your personal data, or you wish to exercise your privacy rights, please contact our Data Protection Officer in the following ways:
Email address: info@binghatticapital.com
Postal address: Binghatti Capital Limited, Unit L19-04A, ICD Brookfield Place, DIFC, PO Box 482010, Dubai, United Arab Emirates
In accordance with Article 16(8) of the Data Protection Law, the contact details of our DPO are published above so that they are readily accessible to third parties.
11. Complaints
You have the right to lodge a complaint with the Commissioner of Data Protection at the DIFC (the supervisory authority for data protection matters in the DIFC) in accordance with Article 60 of the Data Protection Law. You may also have rights to seek remedies before the DIFC Courts in accordance with the Data Protection Law, including under Article 64A. Contact details and further information about the complaints process are available at https://www.difc.ae/business/operating/data-protection/.
However, we would appreciate the opportunity to address your concerns before you approach the Commissioner of Data Protection, so please contact us in the first instance using the details set out in paragraph 10.
If your complaint relates to the conduct of Binghatti Capital as a DFSA-authorised firm, you may also refer your complaint to the DFSA. Further information about the DFSA's complaints process is available at www.dfsa.ae. You may contact Binghatti Capital's complaints team at complaints@binghatticapital.com.
12. Changes to the privacy policy and your duty to inform us of changes
We keep our privacy policy under regular review. This version was last updated on 9 June 2026.
We will notify registered Investor Portal users of material changes to this privacy policy by posting a notice on the Website or by sending an email to the address associated with your account.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.
13. Third-party links
The Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave the Website, we encourage you to read the privacy policy of every website you visit.
This privacy policy is governed by the laws of the Dubai International Financial Centre, including DIFC Data Protection Law No. 5 of 2020 (as amended).
