Ebrahim K. Kanoo B.S.C(C) (The Company) is committed to protecting your privacy. In this policy, we set out how the company collects personal data, how it uses and shares it, and the rights and choices you have in relation to the personal data held and processed by the company. It should be noted that we do not transfer the personal information you provide to any third parties for their own direct marketing use Without your consent.

Where applicable, we comply with Law No. 30 of 2018 with respect to Personal Data Protection on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

This Privacy Policy is separate and in addition to client confidentiality obligations we may owe you. Please refer to our terms and conditions, applicable to your engagement, for further details.

We may collect information from you when you correspond with us or engage our services. We may also collect information as a result of your relationship with one or more of our team, or otherwise in the general course of our business. In each case, your data will be controlled by the company.

Our Privacy Statement

• We respect your privacy and your choices.
• We make sure that privacy and security are embedded in everything we do.
• We do not send you marketing communications unless you have agreed to. You can change your mind at any time.
• We never offer or sell your data.
• We are committed to keeping your data safe and secure. This includes only working with trusted partners.
• We are committed to being open and transparent about how we use your data.
• We do not use your data in ways that we have not told you about.
• We respect your rights, and always try to accommodate your requests as far as is possible, in line with our own legal and operational responsibilities.

For more information about our privacy practices, below we set out what types of personal data we may receive from you directly or from your interaction with us, how we may use it, who we may share it with, how we protect it and keep it secure, and your rights around your personal data. Of course, not all situations may apply to you. This Privacy Policy gives you an overview of all possible situations in which we could interact together.

The more you interact with us, the more we know you, and the more we are able to offer you tailored services.

When you share personal data with us or when we collect personal data about you, we use it in line with this policy. If you have any questions or concerns about your personal data, please contact us at [email protected].

If you apply for a position with the company, we may also collect personal information relating to your past employment, professional qualifications and education, your nationality, health, criminal records and immigration/residential status. We may also gather information from third parties in the form of references and any other information that may be obtained during the recruitment process.

How we collect your personal data?

Personal data is collected at different times and from different sources including but not limited to:

• When you or your organisation contact us to consider engaging our services;
• Information gathered through our client due diligence procedures as part of our compliance requirements with regulatory authorities;
• Through email, fax or telephone communication;
• From third parties; and
• When you or your organisation provides services to us or offer to do so.

How will we use your personal data?

The company understands that personal data is sensitive and is committed to protecting and respecting your privacy. We provide fiduciary, corporate and other professional services to our clients and we use your personal data for these purposes. Normally, the purposes for which we use your personal data will be clear when we collect data. The company will only use your personal information to:

• Perform a contract that we have with you;
• Conduct administrative or operational processes within our business;
• Comply with any legal obligation where the company is required to process your personal information – such as keeping records for tax purposes or providing information to a governmental institution, regulatory body or law enforcement agency;
• Share with third parties relevant to the services that we provide. This may include, but is not limited to, counterparties to transactions or litigation (including law firms acting for other parties), other professional service providers, tribunals or courts;
• Process and respond to requests, enquiries or complaints received from you or someone connected to you;
• Establish, exercise or defend the legal rights of the company or for the purposes of legal proceedings;
• Manage and administer your relationship or your organisation’s business relationship with us, including processing payments, billing and collection;
• For other legitimate business purposes; and
• To review and process your application, should you apply for a position with us.

How we may share the information we collect?

We do not share personal information with unaffiliated third parties, except as necessary for our legitimate professional and business needs, to carry out your request and /or as required or permitted by law or professional standards. This would include:

• Responding to requests from regulatory bodies or law enforcement agencies where it is necessary or prudent to comply with applicable laws or government regulations;
• Sharing with the company service providers, advisors or other third parties if we merge, sell, liquidate or transfer all or a portion of our assets;
• Comply with any legal obligation where the company is required to process your personal information – such as keeping records for tax purposes or providing information to a governmental institution, regulatory body or law enforcement agency;
• Sharing with other third parties as outlined in the section above; and
• Should you apply for a position with us, disclosing your personal information for the purposes of seeking references and confirmation of the details that you have provided.

Retention of personal information and security

Your personal information will be retained for as long as required:

• For the purpose for which the personal information was collected;
• In order to satisfy any reporting or accounting obligations; and
• As required by data protection laws and any other applicable laws or regulatory requirements.

The company has reasonable security policies and procedures in place to protect personal information from unauthorised loss, misuse, alteration or destruction. Despite our best efforts, however, security cannot be absolutely guaranteed against all threats. To the best of our ability, access to your personal information is limited to those who have a need to know. Those individuals who have access to the data are required to maintain the confidentiality of such information. We may keep your personal data in our electronic systems and in paper files.

Access to your personal data

If you have submitted information to the company, you have the following rights:

• To access that data and port (transfer) such personal information;
• To rectify personal information where the information we hold about you is incorrect;
• To restrict the use of personal information;
• To request that personal information is erased;
• To object to processing of personal information; and
• Submit a complaint if you have concerns about the way in which we are handling your data to [email protected].

We cannot be responsible for any loss that may arise due to us having any inaccurate, incomplete, inauthentic or otherwise deficient personal data that you or a third party has provided to us.

Inaccurate or amended information

Please let us know as soon as possible if any of your personal information changes (including your correspondence details). Failure to provide accurate information or to update information when it changes may have a detrimental impact upon our ability to provide services to you.

Your right to erasure under GDPR (General Data Protection Regulation for citizens of EU members States only)

If your data is held under GDPR and you no longer wish for us to hold it, please let us know if you want us to erase your personal data accordingly. Upon your instructions, we will remove in a timely manner and as possible your data from our systems and files. Please note that this provision (known as the right to be forgotten) does not apply outside of the GDPR requirements.

Changes to our Privacy Policy

This Privacy Policy was last updated on 9^th of January 2022. We have the right to update the contents of this Privacy Policy from time to time to reflect any changes in the way in which we process your personal data or to reflect legal requirements as these may change.

Cookie Policy

This declaration regarding Cookies applies to all brands, campaigns and loyalty websites of Ebrahim Khalil Kanoo B.S.C. (c). When opening the company website, you are asked to agree to the optimal website experience on all the company websites. With this, all Cookies are enabled. If you do not want this, you can adjust this via cookie settings. This may affect your user experience when you are on the company websites.

What are Cookies?

Cookies are files or pieces of information that can be stored on your computer (or on other devices with internet access, such as a smartphone or tablet) when you visit the company website. A Cookie usually contains the name of the website where the cookie comes from, the “lifetime” of the Cookie (i.e. how long the Cookie will remain on your computer / device) and a value, which usually consists of a randomly generated unique number.

What do we use Cookies for?

We use Cookies to make the company website easier to use and to better tailor the website and our products to your interests and needs. Cookies can also be used to improve the speed of your future activities and sessions on our websites. We also use Cookies to compile anonymous, aggregated statistics with which we can gain insight into the way people use our websites, so that we can improve the structure and content of the websites. We cannot personally identify you on the basis of this information. In some cases, we link Cookies from our websites to our known customer data. We do this to better tailor the content of our communication to your personal preferences. Cookies that enable this linking always fall under our “optimal Cookies” category.

How to control and delete Cookies?

Most web browsers automatically accept Cookies, but you can change your browser’s settings to prevent that if you wish. However, disabling Cookies would prevent you from using some of our services.

If you wish to restrict or block the Cookies, you can do this through your browser settings. The Help function within your browser should tell you how. For information on how to do this on the browser of your mobile phone, you will need to refer to your handset manual. To opt out of our use of Google Analytics, you may wish to consider using the Google Analytics Opt-out Browser Add-on. Please be aware that restricting Cookies may impact the functionality of our website.

What types of Cookies does the company website use?

As a visitor, you can choose three levels of Cookie use. When choosing functional Cookies, you will receive a minimum set of Cookies, with some functionalities missing on the website. When choosing optimal, the standard setting, you get the most rich website experience as you always were used to.

If you have chosen to consent to our use of Cookies, as outlined on this page, then we place a Cookie called CookieChoice on your computer. This stores the word “Yes” and is set to expire approximately 20 years after you first give us your consent.

Analytics:

We use Google Analytics, which creates a number of first-party Cookies, all prefixed __utm:

__utma: contains a unique and anonymous identifying ID, which allows us to ensure that subsequent visits to our website are recorded as belonging to the same (unique) visitor. This Cookie expires after two years.

__utmb: used to establish and continue a unique user session. Each time you request another page from the website, the Cookie is updated to expire after 30 minutes.

__utmc: works with __utmb to determine when to create a new session for a website visitor. This is a session Cookie and expires when you exit the browser.

__utmz: tracks how you found us and is used to calculate traffic and navigation within the website. It is updated with every new page view and expires after 6 months.

You may also sometimes find a __utmv Cookie, which relates to custom reporting segments, a feature which we occasionally use on Google Analytics.

We don’t believe that our use of Google Analytics is privacy-intrusive. We use the data that is collected in the following ways:

To report, in aggregate, how our visitors find and use our website;

To understand overall visitor behaviour;

To inform how we update and improve our website.

We do allow Google to use this data to collate and aggregate benchmarking data, which they provide to us, about similar websites in our industry. To do this, Google further anonymises the analytics data by removing all identifiable information about our website, and combines the data with hundreds of other anonymous sites in comparable industries.

Our analytics are only shared with our web agencies that help optimizing the websites. We do not share our analytics data with any other third parties.