Privacy Notice

This Privacy Notice explains how Alyff Limited ("Alyff", "we", "us", "our") collects, uses, shares and protects personal information. We may amend or supplement it from time to time.

Alyff is registered in the Abu Dhabi Global Market ("ADGM") with licence number 000008708, and processes personal information in accordance with the ADGM Data Protection Regulations 2021 and other applicable data protection laws. In most cases Alyff is the data controller of personal information provided to us. In some circumstances we act as a processor, processing personal data only on the instructions of a controller or as otherwise permitted by law.

If you have a question about our approach to data protection that is not answered here, please contact us using the details at the end of this notice.

Depending on our relationship with you, we may collect and process:

• basic details, such as your name, role, title, employer, your relationship to another person, marital status, and contact details including email address, street address, telephone numbers and public social media profiles;
• identification and verification data, such as passport and identity document details, utility bills and tenancy agreement details, together with information from publicly available sources used to verify them;
• demographic information, such as gender, date of birth, age, nationality and language preference;
• information relating to the matter on which you are seeking our advice or assistance;
• payment information, such as bank account details, card and other financial information, to the extent relevant to our relationship;
• technical information, such as your location, IP address, browser and traffic data, and engagement data arising from your visits to our website or from our marketing and digital communications;
• records of your visits to our offices, meetings and events, including appointment details, CCTV images and other photographic or video images;
• personal information provided to us by or on behalf of our clients, or generated by us in the course of providing services to them, which may include special categories of personal data; and
• your stated preferences, including how often you wish to receive marketing communications, and any other information you choose to provide.

We collect most personal information directly from you when you contact us or request information, ask us to provide our services, apply for a role with us, provide (or offer to provide) services to us, visit our offices, attend our meetings or events or use our website and online services.

We may also receive personal information from third parties, including our clients, your current or former employer, recruitment and reference agencies, other law firms and professional advisers, other parties to a matter, regulators and government authorities, credit reporting and information service providers, and publicly available records and electronic data sources.

Information you provide may be confidential. We will maintain confidentiality in accordance with our professional obligations and applicable law.

We process personal information only where we have a lawful basis to do so: your consent, where required; the performance of a contract with you, or steps taken at your request before entering into one; compliance with a legal or regulatory obligation to which we are subject; the protection of your vital interests or those of another person; or our legitimate interests, or those of a third party, except where those interests are overridden by your rights and interests.

Where the personal information we process includes special categories of personal data (such as data revealing health, or other sensitive information), we process it only where an additional condition under the ADGM Data Protection Regulations 2021 is satisfied, including where the processing is necessary for the establishment, exercise or defence of legal rights, for compliance with a legal obligation, for the prevention or detection of crime, or on the basis of your explicit consent.

This may include providing our services to you, communicating with you about services or latest developments, managing our business relationship with you, complying with our legal and professional obligations (including, but not limited to, carrying out anti-money laundering and compliance checks), managing and securing access to our computer systems and premises, responding to your enquiries or requests and for other purposes that are related or ancillary to any of the above or other purposes for which your data was provided to us.

We operate a client mailing list, which we use to tell clients and contacts about our services, new developments and events. Our marketing messages may contain tracking technology that records engagement and demographic data and helps us build subscriber profiles for the purpose of direct marketing.

You can change your preferences or unsubscribe at any time by following the instructions in our marketing emails, or by contacting us directly.

Cookies are small files that are sent to a computer’s hard drive by a web server, enabling a website to remember who you are. Information from cookies may include information relating to your use of our websites, information about your computer (such as IP address and browser type), and demographic data. We use cookies on our website.

We may disclose personal information in order to outsource any of the functions described above, to confirm or update information you have provided, to tell you about our services and events, or for other purposes disclosed at or before the time of collection. If we reorganise our business, personal information may be transferred to other group entities or to third parties.

If you tell us you wish to attend an event, your name and organisation may appear on a delegate list provided to other attendees. We take photographs and video at our events, and your image may be captured and used in reporting on the event, including on social media; we will draw this to your attention in materials for the relevant event.

We also share personal information, where necessary to deliver our services effectively, with professional advisers such as lawyers and accountants, government and regulatory authorities, professional indemnity insurers, tax authorities, document processing and transaction services, corporate registries, counsel, arbitrators, mediators, clerks, witnesses, experts, and postal and courier services. We do so where there is an appropriate legal basis, including where you have consented, where we are required to by law, or where it is necessary in connection with legal proceedings or to exercise or defend legal rights. In the course of our business we process personal information using third party technology services, including cloud-based systems and artificial intelligence tools. This may involve your personal information being held on infrastructure managed by the relevant service provider.

It may be necessary for us to transfer personal information on a cross-border basis to our other offices, to service providers and associated professional services firms, and to courts, regulators and enforcement agencies in connection with enquiries, proceedings or investigations, or where we are compelled to do so.

Where we transfer personal information internationally, we do so in accordance with the ADGM Data Protection Regulations 2021: to a jurisdiction that the Commissioner of Data Protection has assessed as providing an adequate level of protection; subject to appropriate safeguards, such as standard contractual clauses adopted by the Commissioner or binding corporate rules; or in reliance on a permitted derogation, including your explicit consent or the necessity of the transfer for the performance of a contract or in connection with legal claims.

Levels of protection vary between jurisdictions and may not always be adequate from an international perspective. Where required, we put in place appropriate safeguards to protect personal information transferred internationally.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, unless we agree a longer retention period with you, or a longer period is required to comply with legal, regulatory, accounting or reporting obligations, or to assert or defend against legal claims.

We use automated and semi-automated tools in delivering our services and running our business. These include AI-assisted document review, translation, tools that help manage email, meetings and tasks, and systems supporting our anti-money laundering and know-your-client procedures. You have the right not to be subject to a decision producing legal effects, or similarly significant effects, that is based solely on automated processing.

Subject to applicable law and relevant circumstances, various rights may be available to you, including:

Withdrawal of consent: when personal information is processed on the basis of consent, you may withdraw consent at any time, although such withdrawal will not affect the lawfulness of processing occurring prior to such withdrawal;

access and rectification right: you may request access to and rectification or erasure of personal information, or restriction of processing concerning you, or to object to processing as well as the right to data portability;

objecting and restricting: you may object, on legitimate grounds, to the processing of your personal information, or request that processing be restricted; and

right to complain: If you believe that your data protection rights may have been breached, you may lodge a complaint with the relevant data protection authority (the ADGM Office of Data Protection).

These rights are subject to the conditions and exceptions provided by applicable law. We will consider requests in accordance with those requirements.

Please direct any question about this notice, or about our processing of your personal data, to:

Alyff Limited
Office 2, Pixel Tower 6
Abu Dhabi
United Arab Emirates
Email: compliance@alyff.com