Privacy Policy

1. Introduction

Gargash Prime is a holding company. Our operating subsidiaries, divisions and affiliated businesses may publish their own privacy notices covering the products and services they provide directly. Where you deal with one of those businesses, its own notice will apply to that relationship in addition to this Policy.

Please read this Privacy Policy carefully. By accessing or using the Site, or by providing personal data to us, you acknowledge that you have read and understood the practices described here.

2. Who We Are and Scope of this Policy

For the purposes of this Privacy Policy, references to the "Gargash Prime Group" mean:

• Gargash Prime and each of its branches;
• any company, association, establishment or other legal entity in which Gargash Prime holds shares or a controlling interest, whether directly or indirectly;
• any company, association, establishment or other legal entity that holds shares or a controlling interest in Gargash Prime, whether directly or indirectly (each a "Parent Entity");
• any entity owned or controlled by a Parent Entity; and
• any entity (including any sole establishment) or branch owned or controlled, singly or jointly, by any person holding shares in a Parent Entity.

Gargash Prime acts as the data controller in respect of personal data collected through the Site and through direct corporate engagement with us. Where a Group company determines the purpose of processing for its own products or services, that company acts as controller for that processing.

This Policy has been prepared having regard to Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data (the "UAE Data Protection Law") and any implementing regulations issued from time to time under it, and to other applicable data protection requirements in the jurisdictions in which we operate.

3. Personal Data We Collect

3.1 Information you provide to us

You are generally under no obligation to provide personal data to us. However, if you choose not to provide certain information, we may be unable to respond to your enquiry, consider your application, or make parts of the Site available to you. Depending on how you interact with us, we may collect:

• Identity and contact details — full name, job title, employer or organisation, email address, telephone or mobile number, and postal address;
• Enquiry content — the subject of your message, the nature of your interest in the Group, and any documents or information you attach or submit through our contact, media, partnership or investor forms;
• Career and recruitment data — CV or résumé, cover letter, employment and education history, professional qualifications, references, work authorisation status and any other information you include in a job application;
• Business and counterparty data — details of a company you represent, commercial proposals, and information required for due diligence, know-your-customer, sanctions screening and onboarding checks;
• Visitor and event data — information captured when you visit our premises or register for an event we host or sponsor, including identification details recorded at reception and dietary or accessibility requirements you choose to share;
• Preferences and feedback — your marketing and communication preferences, and responses to surveys or feedback requests; and
• Any other information you voluntarily provide when corresponding with us by email, telephone, messaging applications or social media.

3.2 Special categories of personal data

We do not ordinarily seek to collect sensitive personal data. Sensitive personal data includes, without limitation, information revealing racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, trade union membership, criminal records, health data, and genetic or biometric data used to uniquely identify an individual. Where processing such data is genuinely necessary — for example, to make workplace accessibility arrangements — we will do so only where we have your explicit consent or another lawful basis permitted under the UAE Data Protection Law.

3.3 Information collected automatically

When you browse the Site, we and our service providers may collect technical and usage information automatically through cookies, server logs, pixels, tags and similar technologies, including:

• Internet Protocol (IP) address and approximate location derived from it;
• device type, operating system, browser type and version, screen resolution and language settings;
• device and advertising identifiers, where applicable;
• the referring page or source that brought you to the Site, and the pages, documents and links you view or click;
• date, time and duration of your visit, session activity and navigation paths; and
• diagnostic data relating to errors, performance and security events.

A cookie is a small text file placed on your browser or device that allows a website to recognise it and retain limited information between pages or visits. A web beacon (also called a pixel or tag) is a small embedded object in a web page or email used to record whether content has been viewed or acted upon.

3.4 Information from other sources

We may receive personal data about you from other companies within the Gargash Prime Group, from our joint venture partners, recruitment agencies, professional advisers, credit and compliance screening providers, and from publicly available or subscription sources such as company registries, regulatory databases, news media and professional networking platforms. We combine this information with data we hold in order to maintain accurate records and to meet our legal and regulatory obligations.

4. How We Use Your Personal Data

We use personal data for the following purposes:

4.1 To operate our business and respond to you

• to respond to enquiries, correspondence and requests submitted through the Site or by other channels;
• to manage relationships with counterparties, suppliers, partners, advisers and other stakeholders;
• to negotiate, enter into and perform contracts, and to administer payments and related records;
• to conduct due diligence, corporate development, investment appraisal and transaction activity carried out by a holding company; and
• to manage the security of our premises, systems and personnel.

4.2 Recruitment

• to assess applications, verify credentials and qualifications, obtain references and conduct pre-employment screening where permitted by law;
• to communicate with you throughout a selection process; and
• to retain your details on file for future opportunities, where you have agreed to this.

4.3 Communications and marketing (where you have consented)

• to send corporate updates, announcements, publications, invitations and event information;
• to administer your participation in events, programmes and surveys; and
• to measure the reach and effectiveness of our corporate communications.

4.4 Analytics and improvement

• to understand how the Site is used, diagnose faults and improve performance, content and accessibility;
• to produce aggregated or anonymised statistics that do not identify any individual; and
• to develop and improve our digital channels and internal processes.

4.5 Legal, regulatory and protective purposes

• to comply with applicable laws, regulations, codes of practice and lawful requests from regulators, courts or public authorities;
• to meet anti-money laundering, sanctions, tax, accounting, audit and corporate governance obligations;
• to establish, exercise or defend legal claims, and to enforce our terms; and
• to detect, prevent and investigate fraud, misuse of the Site, security incidents and other unlawful activity.

If we intend to use your personal data for a purpose that is materially different from those described above, we will inform you and, where required, obtain your consent beforehand.

5. Legal Basis for Processing

We process personal data only where we have a lawful basis to do so. Depending on the circumstances, our basis will be one or more of the following:

• performance of a contract with you, or steps taken at your request before entering into a contract;
• your consent, in particular for marketing communications, non-essential cookies and any processing of sensitive personal data;
• compliance with a legal or regulatory obligation to which we are subject;
• protection of the vital interests of you or another individual; and
• our legitimate business interests — such as managing and developing the Group, securing our systems and premises, and improving our digital channels — where those interests are not overridden by your rights and freedoms.

Where we rely on your consent, you may withdraw it at any time using the contact details in Section 15. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and we may continue to process the relevant data where another lawful basis applies.

6. Marketing Preferences

We will only send you marketing or promotional communications where you have opted in, or where we are otherwise permitted to do so by law. Every marketing email we send includes an unsubscribe mechanism, and you may also contact us directly at any time to change your preferences or ask us to stop contacting you for marketing purposes.

Please note that even if you opt out of marketing, we may still send you administrative, transactional or service-related messages — for example, responses to your enquiries, contractual notices, security alerts or changes to this Policy. Opting out of communications from Gargash Prime does not automatically opt you out of communications from other companies in the Group or from third parties whose services you have separately requested.

7. How We Share Personal Data

We do not sell your personal data. We may share it in the following circumstances:

• Within the Group — with other Gargash Prime Group companies, where necessary for the purposes described in this Policy, including shared corporate, technology, human resources, finance and compliance functions;
• Service providers — with vendors who process data on our behalf and under our instructions, such as hosting and cloud providers, website and application developers, email and CRM platforms, analytics providers, recruitment systems, security services, printing and archiving services;
• Professional advisers — with lawyers, auditors, accountants, insurers, bankers and consultants bound by duties of confidentiality;
• Transaction counterparties — with prospective or actual buyers, sellers, investors or joint venture partners, and their advisers, in connection with a merger, acquisition, restructuring, financing, reorganisation, dissolution or transfer of all or part of our business or assets;
• Authorities — with regulators, law enforcement agencies, courts and government bodies where we are required or permitted to do so by law, or where disclosure is necessary to protect our rights, property or safety, or those of others; and
• With your consent — with any other recipient you have instructed or authorised us to share with.

We require our service providers to implement appropriate confidentiality and security measures, and we do not permit them to use your personal data for their own independent purposes.

8. International Transfers

Some of the recipients described above may be located outside the United Arab Emirates. Where we transfer personal data across borders, we take steps to ensure the data continues to receive an adequate standard of protection. Transfers will be made on the basis of appropriate safeguards such as contractual protections, your consent, or another ground permitted under the UAE Data Protection Law, including (where applicable) transfer to a jurisdiction recognised as providing an adequate level of protection. You may request further details of the safeguards we apply using the contact details in Section 15.

9. Data Security

We maintain administrative, technical and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised access, disclosure or misuse. These measures include access controls and role-based permissions, encryption of data in transit, network and endpoint security controls, logging and monitoring, secure disposal procedures, vendor security assessments, and staff awareness training.

While we take security seriously, no method of transmission over the internet and no system of electronic storage is completely secure. You are responsible for keeping any credentials you use to access our systems confidential, and for notifying us promptly if you believe your information has been compromised. Where a personal data breach is likely to prejudice your privacy or confidentiality, we will notify you and the competent authority in accordance with applicable law.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, tax, accounting, audit or reporting requirements. Retention periods vary according to the nature of the data and the purpose of processing. Indicative periods include:

For any category of personal data not listed in the table above (including visitor and event data, business and counterparty data, and any special category data described in Section 3.2), we retain it only for as long as necessary for the purpose for which it was collected, applying the general principles set out in this Section. We may retain data for longer where a complaint, investigation, dispute or prospective litigation makes it reasonably necessary to do so. When data is no longer required, we securely delete it or irreversibly anonymise it.

11. Your Rights

Subject to the conditions and exemptions set out in the UAE Data Protection Law, you have the following rights in relation to your personal data:

• Access — to be informed whether we process your personal data and to obtain a copy of it, together with information about how it is processed;
• Rectification — to have inaccurate or incomplete data corrected or completed;
• Erasure — to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing was based on consent that you have withdrawn;
• Restriction — to request that we limit processing in defined circumstances, such as while the accuracy of data is being verified;
• Objection — to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes;
• Data portability — to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible;
• Withdrawal of consent — to withdraw consent at any time where processing is based on it;
• Automated decision-making — to request human review of a decision produced solely by automated processing that has a legal or similarly significant effect on you; and
• Complaint — to lodge a complaint with us or with the competent data protection authority.

To exercise any of these rights, please contact us using the details in Section 15. We may need to verify your identity before acting on your request. We will respond within the period required by applicable law. There is normally no charge, although we may levy a reasonable fee or decline to act where a request is manifestly unfounded, excessive or repetitive. You will not be disadvantaged for exercising your rights.

12. Cookies and Similar Technologies

When you first visit the Site, you will be presented with a cookie banner allowing you to accept or decline non-essential cookies. Strictly necessary cookies, which are required for the Site to function and to remain secure, cannot be disabled. Your preferences are stored and applied to subsequent visits, and you may change them at any time through the cookie settings on the Site.

You can also manage cookies through your browser settings, including blocking cookies or requesting notification when one is set. Guidance is normally available in your browser's help section. Please note that disabling cookies may affect the availability or performance of certain features on the Site. Where we publish a separate Cookie Notice, it forms part of this Privacy Policy.

13. Other Important Information

13.1 Links to third-party websites

The Site may contain links to websites, platforms and applications operated by Group companies or by unrelated third parties. Those destinations are governed by their own privacy notices and terms. We are not responsible for the content, security or privacy practices of any website or application we do not control, and we recommend that you review the applicable notice before providing personal data.

13.2 Children

The Site is intended for a business and professional audience and individuals under the age of 18 are not permitted to use the Site. We do not knowingly collect personal data from individuals under the age of 18. If you believe a child has provided personal data to us, please contact us so that we can take appropriate action.

13.3 Language

This Privacy Policy may be published in English and Arabic. In the event of any inconsistency between the two versions, the Arabic version shall prevail to the extent required by applicable law.

14. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal and regulatory requirements. The version published on the Site is the current version, and the "Last updated" date at the top of this document indicates when it was most recently revised. Where changes are significant, we will post a prominent notice on the Site and, where appropriate, notify you directly. We encourage you to review this Policy periodically.

15. How to Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or would like to make a complaint about how we handle your personal data, please contact us:

We will acknowledge and seek to resolve your request promptly. If you are not satisfied with our response, you may refer the matter to the UAE Data Office or another competent supervisory authority.