DATA PRIVACY NOTICE 

M/HQ is committed to ensuring that any personal data, including special categories of personal data, that M/HQ processes, is carried  out in compliance with applicable data protection laws.  

This Data Privacy Notice explains the manner in which M/HQ collects, uses, maintains and discloses personal data obtained through  its website, offices, events and/or the provision of services.  

M/HQ is the data controller of your personal data and is subject to the DIFC Data Protection Law (DIFC Law no 5 of 2020), DIFC  Data Protection Regulations, ADGM Data Protection Regulations 2021 and the UAE Federal Data Protection Law No. 45 of 2021 and  associated regulations and is committed to compliance with the EU General Data Protection Regulation 2016/679 (collectively, the  “Data Protection Law”).  

This Data Privacy Notice applies to: 

• past, present and prospective M/HQ clients (“you”); 
• anyone involved in any transaction or interaction with M/HQ, whether in a personal capacity or as a representative of a legal entity (for example, director, a company manager, agent, legal representative, operational staff, other authorized representative, etc.); and 
• M/HQ’s employees, advisors and consultants. 

Terms contained in this Data Privacy Notice have the meaning attributed to them under the Data Protection Law, as applicable. 

Method of collection of personal data 

M/HQ obtains your personal data from the following sources:  

• information you provide to M/HQ when you meet or interact with M/HQ; 
• information about you provided to M/HQ by your company or an authorized intermediary; 
• communications with M/HQ by telephone, email or other forms of electronic communication. In this respect, M/HQ may monitor, record and store any such communication; 
• completion of on-boarding forms or other applications; 
• your agents, advisers, intermediaries, and custodians of your assets; or 
• publicly available sources or from third parties, most commonly where M/HQ needs to conduct background checks about you. 

Types of personal data collected 

In the course of M/HQ’s relationship with you, M/HQ may collect the following data about you and, in some circumstances, your  spouse, beneficiaries or dependants: 

• identification details: name, date of birth, nationality, passport number; 
• contact details: address, telephone, email; 
• marital status and other data, deemed “special category of personal data” regarding lifestyle, sexual orientation or religion; • tax identification number; 
• bank details; 
• source of wealth and funds; and 
• where applicable and legally permissible, audio-visual data such as surveillance videos, recording of phone or video calls or chats  with our employees or officers. 

Special categories of personal data (or sensitive data) means data relating to your health, ethnicity, religious and political beliefs,  genetic or biometric data, or criminal data. M/HQ may process special categories of personal data if:  

• M/HQ receives your explicit consent to do so; or 
• M/HQ is required or allowed to do so by applicable local law (for instance, to comply with anti-money laundering and terrorism financing know your client customer due diligence monitoring). 

Processing of personal data 

Processing means every activity that can be carried out in connection with data such as collecting, recording, storing, adjusting,  organizing, using, disclosing, transferring or deleting it in accordance with applicable laws. The legal basis for M/HQ’s processing of  your personal data and special categories of personal data includes: 

• to prepare a proposal for services to be provided under contract with you; 
• to perform and conclude a contract with you; 
• to comply with legal obligations; and 
• for M/HQ’s legitimate business interests. 

The purposes for which M/HQ processes your data include: 

• to perform due diligence and comply with regulatory obligations (including anti money laundering legislation); • to incorporate a legal entity or branch of a legal entity (e.g. where you are a member or director); • to administer a legal entity generally (as registered agent and/or to monitor and assist with annual compliance obligations); • keeping documents (e.g. wills) in safe custody; 
• to make payments; 
• to prepare private contractual arrangements such as loan agreements, share pledges, call option agreements; • to raise and send invoices; 
• to terminate a relationship involving a data subject; 
• to conduct internal reviews and compile internal reports; 
• for record keeping purposes; 
• to generate reports for you (including risk reports); 
• to respond to a request from an auditor, or a regulatory or supervisory body; 
• to apply for visas; 
• to establish bank accounts and interaction with banks on your behalf; 
• to administer deceased estates on your instruction; 
• to otherwise fulfil your instructions, provide the advice and assistance that M/HQ is engaged to provide, service the legal entity, or comply with our legal obligations. 

Right to refuse to provide personal data  

In some cases, M/HQ is legally required to collect personal data, or your personal data may be needed before M/HQ can perform certain services and provide certain products. M/HQ undertakes to request only the personal data (or special categories of personal  data) that is strictly necessary for the relevant purpose. Failure to provide the necessary data may cause delays or lead to refusal  of certain products and services.  

Right to refuse to provide personal data 

From time to time, M/HQ may be required to disclose your data to comply with legal obligations to governmental agencies or entities, regulatory authorities or other persons in line with any applicable law, regulations, court order or official request. In any other case,  M/HQ may share your personal data with the following for the purposes of undertaking the contract for services with you: 

• to entities within the M/HQ group; 
• to professional advisors such as lawyers, accountants, financial advisors and third party sub-contractors; and • other financial institutions such as banks, insurance and investment companies. 

Whenever M/HQ shares your personal data externally with third parties in jurisdictions without a deemed adequate level of protection of personal data, M/HQ ensures the necessary safeguards are in place to protect it in accordance with the applicable law. For  example, M/HQ uses standardized contractual clauses in agreements with third parties engaged in connection with services provided  to you to ensure personal data transferred to jurisdictions without an adequate level of protection of personal data comply with the  Data Protection Law. 

Measures to protect your personal data 

M/HQ takes appropriate technical and organizational measures (policies, procedures, IT security, etc.) to ensure the confidentiality  and integrity of your personal data and special categories of personal data and the way it is processed. M/HQ applies an internal  framework of policies and minimum standards across its business to keep your data safe. These policies and standards are period ically updated. In addition, M/HQ’s employees are subject to confidentiality obligations and may not disclose your data unlawfully  or unnecessarily. To help M/HQ continue to protect your personal data, you should always contact M/HQ if you suspect that your  personal data may have been compromised. 

Your rights 

Unless legal exemptions apply, you shall have the right: 

• to be informed about how M/HQ uses your data; 
• to access your data; 
• to have your data rectified promptly if it is inaccurate or incomplete; 
• to have your data erased where there is no compelling reason for its continued processing. It is not an absolute right and can be used in specific circumstances such as: 
  • where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed and there is no legal obligation on M/HQ to keep it; 
  • where you withdraw consent where the sole basis for processing was consent; 
  • where you object to the processing and there is no overriding legitimate interest for continuing the processing; » the personal data was unlawfully processed; and 
  • the personal data must be erased in order to comply with a legal obligation. 
• to restrict processing where one of the following applies: 
  • you contest the accuracy of your personal data held by M/HQ while M/HQ investigates/rectifies the inaccuracy; » the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead; and 
  • you have objected to processing pending the verification whether the legitimate grounds of the controller override those of your own. 
• to not be subject to a decision based solely on automated decision making including profiling; 
• to object to processing activities such as: 
  • direct marketing (including profiling); and 
  • processing for the purposes of scientific/historical research and statistics. 
    “Profiling” is the automated processing of your personal data to evaluate certain things about you. 
• to data portability where the processing is based either on consent or on the performance of a contract and the processing is carried out by automated means. 

Privacy breaches 

Should a privacy breach occur, M/HQ will notify you as soon as possible following identification of the breach. This notification will include: 

• date of the breach; 
• description of the breach; 
• description of the information inappropriately accessed, collected, used or disclosed; 
• the steps taken so far to control or reduce the harm; 
• future steps planned to prevent further privacy breaches; 
• steps you might consider taking; 
• contact details of the relevant supervisory body; and 
• M/HQ’s contact details. 

Cookies 

A cookie is a small element of data that a website can send to your computer’s browser so that your computer will be recognised by M/HQs website on your return. Cookies contain information that is transferred to your computer’s hard drive. You may refuse to accept cookies by activating the relevant setting on your web browser that allows you to control the setting of cookies. However, for optimal use of M/HQ’s website, M/HQ recommends that you do not block the recording of cookies on your computer as it may prevent you from accessing certain areas or features of M/HQ’s website. 

Security 

M/HQ is committed to implementing and maintaining appropriate safeguards to ensure that your personal data is kept secure and  confidential and is protected against reasonably anticipated threats to its security or integrity, and against unauthorised access or  use that might result in substantial harm or inconvenience to data subjects. 

Making a complaint  

As a data subject you have a right to lodge a complaint within a supervisory authority in: 

• your place of residence; 
• your place of work; and 
• the location of the alleged infringement. 

Supervisory authorities: 

• ADGM Office of Data Protection 
• E.U. Data Protection Authorities 
• DIFC Commissioner of Data Protection 

Retention and destruction of personal data 

M/HQ will retain your personal data for the entire duration of the contractual relationship. After the end of the contractual relation ship, M/HQ will retain data according to the applicable law, but no longer than what is required by the applicable law or the statute  of limitation for civil liability. Beyond, the data shall be destroyed or anonymised. 

Changes to this Data Privacy Notice 

We may amend this Data Privacy Notice to remain compliant with any changes in Data Protection Law or to reflect how M/HQ  processes personal data. 

Our contact details  

If you have any questions or concerns about personal data or this Data Privacy Notice or you wish to make a complaint about how  M/HQ has processed your personal data, or you wish to exercise any of your rights as a data subject, please contact M/HQ. 

Who we are 

We are a multi-services platform catering to a broad spectrum of clients – from individual entrepreneurs and local SMEs to wealthy international  families, to established blue-chip companies and multinationals. Our one-stop-shop offering is unique in the Middle East: a holistic and cross-disciplinary combination of a market-leading corporate services firm, a law firm’s specialist expertise and a regulatory & compliance services practice,  all through one single platform. 

We have broad experience advising successful individuals and international families on a broad range of legacy planning and wealth structuring  issues, including structuring of operational and non-operational assets. We are regularly assisting clients on all aspects of a SFO – e.g. defining the  family’s vision; identifying, fine-tuning and implementing governance aspects and management strategies; selecting, incorporating and providing  ongoing support to the appropriate structure. 

Headquartered in the UAE, we are an entrepreneurial firm for entrepreneurial clients.