Data Privacy Notice

Personal Data and Processing have very specific meanings under the UAE Applicable Laws, including under the DIFC Data Protection Law, it is important that you understand these terms.

What is Personal Data?

Personal Data means any data which relates to a living individual who can be identified directly or indirectly from that data. The definition includes a wide range of personal identifiers that constitute Personal Data, or to one or more factors specific to their biological, physical, biometric, physiological, mental, economic, cultural, or social identity.

Examples of Personal Data include, but are not limited to the following:

• Address
• Contact information
• Date of birth
• Financial data
• Gender
• Identification number (e.g., national id, passport number, and driver’s license number)
• Location data (e.g., gps coordinates)
• Marital status
• Name
• Photographs, videos, voice recordings
• Telephone, mobile, fax numbers and email addresses
• Transactional data
• Website technical data (e.g., your internet protocol (Ip) address, website login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites)
• Website profile and usage data (e.g., your interests, preferences, feedback and survey responses, information about how you use our websites)
• Transaction details while performing online payments (e.g., merchant name, location, device used).

What is Processing?

Processing means doing anything with Personal Data, e.g., viewing, collecting, using, storing, sharing, manipulating, printing, copying, archiving etc.

Processing activity means any task that involves doing anything with Personal Data.

Processing as per DIFC Data Protection Law means:

any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage and archiving, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, transfer or otherwise making available, alignment or combination, restricting (meaning the marking of stored Personal Data with the aim of limiting Processing of it in the future), erasure or destruction, but excluding operations or sets of operations performed on Personal Data by:

(a) a natural person in the course of a purely personal or household activity that has no connection to a commercial purpose; or

(b) law enforcement authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security.

Personal Data That You Provide to Us

ENBD AM collects Personal Data directly from you as our Customer or Potential Client ENBD AM collects information you provide directly to us through your access or use of ENBD AM Products and Services. For example, when you apply for a product or Service on our website(s), by telephone or when you enter an ENBD AM premises and engage with one of ENBD AM’s employees.

Personal Data ENBD AM Collects About You from Other Sources

ENBD AM may collect Personal Data about you from other sources such as, but not limited to the following:

• Representative(s) of a corporate client.
• Legal representatives (power of attorney) of a client.
• People appointed to act on your behalf.
• Other Emirates NBD Groups.
• Your employer.
• Credit Bureaus or credit reporting agencies.
• Digital identity solutions.
• Government databases.
• Law enforcement officials.
• Co-borrowers / guarantors.
• Criminal records check from organisations authorised to provide this data.
• Beneficiaries of your payment transactions.
• Nominated contact person by an existing account holder.
• Third party providers and partners to help us improve the Personal Data ENBD AM hold and to provide more relevant and interesting products and Services to you.
• Reference contacts provided in the application form by you.

Personal Data ENBD AM May Collect About Other Individuals

In certain circumstances, ENBD AM may be provided Personal Data from you about individuals who do not have a direct relationship with us. This may happen, for instance, when you provide us with Personal Data about:

• Beneficiaries of your payment transactions.
• Co-borrowers / guarantors.
• Employers of ENBD AM Customers.
• Landlords.
• Legal representatives (power of attorney) of a client.
• Next of Kin
• Reference contacts provided in the application Representative(s) of a corporate client.
• Shareholder(s)/Director(s) of a corporate client.
• Spouses
• Successors and right holders.
• Ultimate beneficial owners.
• Form by an ENBD AM (potential) Customer.

Personal Data includes information that ENBD AM collect and process about you depending on the products or Services you obtain or receive.

The below is a non-exhaustive list which highlights some, but not all, examples of categories of Personal Data ENBD AM collect about you:

ENBD AM only discloses your Personal Data outside of ENBD AM in limited circumstances. If ENBD AM does share the Personal Data outside of ENBD AM, we will put in place appropriate controls and data sharing/processing agreements that require recipients to protect your Personal Data, unless ENBD AM is legally required to share that Personal Data. All contractors or recipients that work for ENBD AM will be obliged to follow ENBD AM instructions. ENBD AM does not sell your Personal Data to third parties.

ENBD AM may disclose your Personal Data to ENBD AM third-party Service providers, agents, and subcontractors (Suppliers) for the purposes of providing Services to us or directly to you on ENBD AM’s behalf.

When ENBD AM uses Suppliers, ENBD AM only discloses to them the Personal Data that is necessary to provide their Services and only where ENBD AM has a contract in place which requires them to keep your Personal Data secure and not to use it other than in accordance with ENBD AM’s specific instructions. ENBD AM take steps to ensure that any third-party service providers who handle your Personal Data comply with the Applicable Laws and protect your Personal Data to the same extent that ENBD AM does. ENBD AM will aim to anonymise your Personal Data or use aggregated non-specific data sets where possible. Find below the supporting Schedule with a list of categories of third parties with whom ENBD AM may share your data.

ENBD AM websites and apps are intended for use only by persons who are at least 18 years of age. If you are under the age of 18, your parent or guardian must consent on your behalf where ENBD AM asks for consent in relation to the use of your Personal Data.

The way ENBD AM analyses Personal Data relating to ENBD AM Services may involve profiling or other automated methods to make decisions about you that relate to the following:

• Credit and affordability checks (including credit limits) – ENBD AM will consider several factors including information about your income, expenses and how well you have kept up on payments in the past.
• Anti-money laundering, sanctions checks and screening 'politically exposed' people.
• Monitoring your account for fraud and other financial crime – ENBD AM will assess your transactions to identify any that are unusual.
• Assessments required by regulators and appropriate authorities.

You may have a right to certain information about how ENBD AM make these decisions. You may also have a right to request human intervention in case it pertains to a fully automated process and to challenge the decision. Refer the “How to Contact Us” section for further details on reaching out to us with your request.

ENBD AM needs your Personal Data to provide you with the Services or products requested by you. On execution of the investment management agreement, you authorize Emirates NBD Asset Management to hold and process both electronically and manually, the data (including personal sensitive data and information contained in e-mail and e-mail attachments) it collects, stores and / or processes, which relate to you for the purposes of the administration and management of its business, you also agree to Emirates NBD Asset Management forwarding this data to other offices it may have for storage, processing, or administrative purposes and consent to Emirates NBD Asset Management disclosing personal data collected from you (including sensitive personal data) to third parties where such disclosure is for the legitimate business purposes of Emirates NBD Asset Management or is necessary for administrative (including but not limited to data processing) personnel, management, legal and/or regulatory purposes.

MARKETING

It is voluntary for you to provide us your Personal Data or consent for direct sales or marketing purposes.

ENBD AM makes it clear on the ENBD AM physical application forms, during your onboarding digitally and on all communications received from the Bank as to what data is required to be provided by you by marking the mandatory fields with the asterisk symbol (*). You can object to further marketing at any time by:

• Calling Emirates NBD Asset Management Customer Call Centre on +971 4 3700022.
• Sending an email to assetmanagement@emiratesnbd.com

Further details of how ENBD AM will use your Personal Data can be found below.

ENBD AM collects Personal Data about your internet activity using technology known as cookies, which can often be controlled through internet browsers and by using ENBD AM cookie preference center on the ENBD AM website.

• Technical information, such as your IP address and device ID.
• Information about your visit, such as your URL and website interaction.
• Location data, with your approval, used to show you the location of the nearest branch or ATM based on your IP address, coordinates or a unique device code.
• Networks and connections, when you interact with us and the people and groups that you are connected to (for example, through social media).

ENBD AM is a global organisation, and your Personal Data may be stored or processed in any country where ENBD AM has facilities or in which ENBD AM engages Service providers and subcontractors. ENBD AM has put in place appropriate safeguards in accordance with applicable legal and data protection requirements to ensure that your data is adequately protected.

ENBD AM, its officers, and employees may use, store, process, disclose, transfer (including outside the place in which the Client’s accounts are held) and exchange information to or with any person that the Asset Manager considers necessary or desirable for any purpose in connection with Services or in order to comply with Applicable Laws or the Asset Manager’s internal policies and procedures.

You have certain rights in respect of your Personal Data, and ENBD AM have processes to enable you to exercise these rights. Your rights are as follows:

• Opt Out / Unsubscribe: You can request to be removed from the ENBD AM marketing mailing list, from the unsubscribe button in the email itself. We have other channels to request removal as well, such as calling the customer care centre and sending SMS to the designated number communicated to you as part of the marketing content.
• Right to Access (also known as a ‘Subject Access Request’): You have the right to obtain confirmation as to whether ENBD AM processes Personal Data about you, receive a copy of your Personal Data held by us, and obtain certain other information about how and why ENBD AM processes your Personal Data.
• Right to Rectification: You have the right to request for your Personal Data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete Personal Data completed.
• Right to Erasure (also known as 'the Right to be Forgotten'): You have the right to deletion of your Personal Data in the following cases:
• The Personal Data are no longer necessary in relation to the purposes for which they were collected and processed.
• Where our lawful basis for processing your information is consent and you then withdraw your consent. However, please note that the lawfulness of any previous processing carried out based on your valid consent earlier shall not be affected.
• Our lawful basis for processing is that the processing is necessary for a legitimate interest pursued by ENBD AM, you object to our processing, and ENBD AM do not have overriding legitimate grounds.
• You object to our processing for direct marketing purposes and advanced analytics.
• Your Personal Data has been unlawfully processed.
• Your Personal Data must be erased to comply with a legal obligation to which ENBD AM are subject.
• Right to Object: You have the right to object to our processing of your Personal Data in the following cases:
• Our lawful basis for processing is that the processing is necessary for a legitimate interest pursued by us.
• Our processing for direct marketing purposes and advanced analytics.
• Right to Data Portability: You have the right to request for your personal information to be prepared and arranged and sent to another organisation (or ask us to do so if technically feasible).
• Right to Withdraw Consent: Where ENBD AM process Personal Data based on consent, individuals have a right to withdraw their consent at any time. To do so, please use the contact details below in the “How to Contact Us” section.
• Right to Lodge a Complaint with a Supervisory Authority: ENBD AM sincerely hope that you will never need to, but if you do want to complain about our use of Personal Data, please send an email with the details of your complaint using the contact details set out below. You may lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred. The contact details of the competent national supervisory authority, The Commissioner of Data Protection (“Commissioner”), are as follows:

Address: Dubai International Financial Centre Authority, Level 14, The Gate, Dubai, UAE.
Telephone: +971 4 3622222
Website/Email: commissioner@dp.difc.ae

Please note, all rights are subject to qualifications and limitations. In other words, there may be instances and justifiable grounds to deny any request where ENBD AM are required or permitted by law to do so. ENBD AM will always be clear and communicate this to you if these instances arise.

Also note, for the purpose of upholding the security, confidentiality, and integrity of your Personal Data, ENBD AM may verify your identity before allowing you to access your Personal Data.

The Security of your Personal Data is important to us. We make every effort to ensure that your Personal Data is secure on our system. ENBD AM has staff dedicated to maintaining the ENBD AM security standards as set forth herein. ENBD AM implements technical and organisational measures to ensure a level of security appropriate to the risk to the personal information ENBD AM processes. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. ENBD AM evaluates these measures on a regular basis to ensure the security of the processing.

Your ENBD AM profile is password-protected so that only you and authorised ENBD AM employees have access to your account information. ENBD AM staff will never reach out to you and ask for any personal account information, including your password.

ENBD AM make every effort to ensure that your Personal Data is secure on its system. ENBD AM have staff dedicated to maintaining the ENBD AM security standards as set forth herein. ENBD AM implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information ENBD AM process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. ENBD AM evaluate these measures on a regular basis to ensure the security of the processing.

Unfortunately, you would appreciate that, no data transmission over the Internet can be fully guaranteed to be 100% secure. As a result, ENBD AM cannot guarantee the security of any Personal Data you transmit to us, and you do so at your own risk.

Whilst ENBD AM takes measures to secure your Personal Data, risks to data security do exist, and there is always a possibility of unauthorised use, disclosure, modification and/or destruction of your Personal Data. In the event of a Personal Data Breach, ENBD AM will notify you about it and its likely consequences, measures taken by us to mitigate the increased risk and avenues available to you to mitigate the risk as a result of the Personal Data Breach.

For reporting Personal Data Breaches or further information on how ENBD AM respond to and handle Personal Data Breaches, please contact us at assetmanagement@emiratesnbd.com.

The ENBD AM website and apps may, from time to time, contain links to external sites. If you follow a link to any of these websites, please note that these websites have their own Data Privacy Notices. Please check these Notices before you submit any Personal Data to these websites. ENBD AM is not responsible for the Data Privacy Notices, content of such sites or any Personal Data collected by such sites.

ENBD AM has appointed a Data Protection Officer (“DPO”) to oversee compliance with this Data Privacy Notice. The DPO can be contacted on ENBDAMDPO@emiratesnbd.com.

ENBD AM will keep your Personal Data for as long as ENBD AM has a relationship with you. Once the ENBD AM relationship with you has come to an end, ENBD AM will retain your Personal Data for a period that enables us to:

• Maintain business records for analysis and/or audit purposes.
• Comply with record retention requirements under the law.
• Defend or bring any existing or potential legal claims.

ENBD AM will delete your Personal Data when it is no longer required for these purposes. If there is any information that ENBD AM is unable, for technical reasons, to delete entirely from ENBD AM systems, we will put in place appropriate measures to prevent any further processing or use of the data.

In some circumstances you can ask us to delete your data. For further information, please see the “What are your Rights” section.

If you have questions or concerns regarding the way in which your Personal Data is being used, please contact the ENBD AM Data Privacy Office by emailing ENBDAMDPO@emiratesnbd.com.

If you are unsatisfied with the way your Personal Data is being processed, please raise a complaint by reaching out to assetmanagement@emiratesnbd.com.

If you would like to lodge a complaint to your local supervisory authority, please get in touch and ENBD AM will provide you with instructions and contact details to your local supervisory authority.

If you would like to stop receiving marketing or promotional communications, please email ENBD AM at assetmanagement@emiratesnbd.com or call at +971 4 3700022 or by unsubscribing through any of the communications received.

ENBD AM are committed to working with you to obtain a fair resolution to any complaint or concern you may have. If, however, you believe that ENBD AM have not been able to assist with your complaint or concern you have the right to make a complaint to the data protection authority of your country.

ENBD AM may occasionally update this notice. If ENBD AM make significant changes, ENBD AM will notify Customer in advance of the changes through the ENBD AM apps or through other means, such as email. ENBD AM encourages Customers to periodically review this Data Privacy Notice for the latest information on the ENBD AM data privacy practices.

Should you wish to contact us to discuss any questions, concerns, and comments you may have regarding your Personal Data that we process, please reach us through our contact details provided in the “How to Contact Us” section of this Notice.