This Data Protection and Privacy Notice ("Notice") is issued by CW Partners – FZCO (the "Firm"), an entity established and regulated by the Dubai Integrated Economic Zones Authority (“DIEZ”), United Arab Emirates, and applies to the members of CW Partners' network, its direct or indirect subsidiaries, divisions and/or its branches and/or affiliates.

The Firm is committed to protecting your privacy and your Personal Data. The Firm respects your right to privacy and processes your Personal Data in accordance with applicable privacy laws.

This Notice sets out (i) what Personal Data the Firm collects, (ii) how the Firm collects and uses the Personal Data, and (iii) the rights you have in relation to the Personal Data.

Personal data means any information relating to an identified or identifiable natural person. The Firm collects and processes the following types of Personal Data:

• Name, address, email address, telephone number and other contact information;

• Date and place of birth;

• Nationality;

• Gender;

• Employment details;

• Marital status;

• Father's name;

• Mother's name;

• Religion;

• Copies of identity documents (such as passport, national ID, driver’s license, Employee Identification Number, Tax Identification Number);

• Copies of documents relating to your Source of wealth;

• Utility bills, bank statements and confirmation letters;

• Tax residency;

• Details of shareholdings and other assets which are legally or beneficially owned by you; and

• Details of people and organisations which may be connected to you (e.g. family or otherwise).

Please note that the above list is not exhaustive, and the Firm may also collect and process Personal Data to the extent this is useful or necessary for the provision of the Firm services and/or to comply with local laws.

The Firm obtains and processes Personal Data in different ways.

• Personal Data provided to the Firm directly: The Firm collects Personal Data directly from (prospective) clients, business partners and intermediaries for entering into contracts or service agreements and/or to meet certain legal requirements.

• Personal data obtained from third parties: The Firm collects and processes Personal Data from publicly accessible sources such as the internet, social networks, World-Check or commercial registers. The Firm may also receive Personal Data from third parties as part of the service provided to you or to connected individuals (including but not limited to organisations where you hold a shareholding or employment contract) or in connection with legal requirements that are applicable to the Firm.

The Firm primarly processes Personal Data to:

• Perform contract with data subject or comply with their requests prior to entering into contracts;

• Fulfill legal and regulatory obligations;

• Pursue legitimate business interests, including general research, development (including statistical research or as a basis to analyze its current security measures), administration of its business and systems, including information technology, billing and invoicing systems or to develop and improve its services or to strengthen its relationship with you.

The Firm may provide you with communications or information regarding service offering which we think will be interesting for you. When processing your Personal Data for legitimate business interests, or where consent to process personal data was received, the Firm will consider and balance any potential impact on you and your rights under the relevant data protection and any other relevant law. Whenever we process Personal Data for these purposes you have the right to object to such processing.

The Firm may disclose or transfer Personal Data:

• To its group companies insofar as reasonably necessary for the purposes of its service offering or for bona fide compliance purposes as well as on the legal basis as set out in this Privacy Notice;

• To subcontractors, intermediaries or external advisors for the purpose of the proper performance of the services the Firm provides to its clients. It may, for example, disclose or transfer such Personal Data to third party service providers who provide administrative, computer, payment, data processing, debt collecting or other services. The Firm may enter into data processing agreements with such subcontractors to ensure that they process your data, on its behalf, with the same level of security and confidentiality as applied by the Firm;

• To protect its rights or those of its clients and/or to prevent fraud.

• To competent authorities to comply with its legal and/or regulatory obligations.

Except as described in this paragraph, the Firm does not disclose, transfer or sell your Personal Data to any third party without your explicit consent.

The Firm may disclose or transfer Personal Data to group companies located in countries outside the UAE with the above purposes.

Personal Data is stored by the Firm on its servers, and/or those of the cloud-based database management service providers the Firm engages.

If disclosure or transfer of Personal Data is being done in a country that does not ensure an adequate level of protection of your Personal Data, the Firm will implement additional safeguards.

The Firm will process and store the relevant Personal Data:

• For the duration of its services or of the business relationship;

• As necessary to fulfill legal, contractual or statutory obligations;

• For the establishment, exercise or defense of legal claims; and

• In general where it has a legitimate interest for doing so.

You have the following rights:

Access to your Personal Data

You have the right to access the Personal Data that the Firm holds about you at any time.

Correction of your Personal Data

You have the right to ask the Firm to update and correct any out-of-date or inaccurate personal Data that the Firm holds about you at any time.

Deletion of your Personal Data (right to be forgotten)

You have the right to ask the Firm to delete your Personal Data, to the extent that the Firm has no legal and/or regulatory obligations to keep such Personal Data.

Restriction of processing of your Personal Data

You have the right to ask the Firm to restrict the processing of your personal Data in case:

• You contest the accuracy of the Personal Data held by the Firm;

• The processing is unlawful but you object to the deletion of the Personal Data and request the restriction of the use instead;

• The Firm no longer needs the Personal Data for the purposes of the processing, but you require them for legal reasons; and

• You object to processing and the Firm is investigating whether there are legitimate grounds to override your objection.

Automatic Decision Making

The Firm does not make decisions by purely automatic means, but if we do, you have the right to object.

Objection

You have the right to object at any time to the processing of your Personal Data for any direct marketing (and related profiling) by the Firm.

If you wish to exercise any of the above rights, you can contact the Firm using the contact details below.

You may also file complaints with the local supervisory authority with respect to the way the Firm is processing your Personal Data or the way the Firm is handling your rights.

The Firm is the controller of Personal Data collected through the Firm’s website (the "Website").

The Firm collects personally identifiable information on certain areas of the Website when users register, request publications or other information, sign up for conferences and events, apply for jobs, and participate in user posting areas, such as bulletin boards, discussion forums, and surveys, as applicable. The personally identifiable information collected may consist of information that you provide, such as names, mailing addresses, email addresses, telephone and fax numbers, and, for recruiting purposes, any other personally identifiable information on your resume.

The Website also uses cookies to identify you and your interests and to track usage of the Website. Cookies are small pieces of text stored on your computer that help us know which browser you are using and where you have been on the Website and on websites to which you may link to use some of its features. A user who does not accept the cookie from the Website may not be able to access certain areas of the Website. The Firm also logs IP addresses, or the location of computers on the Internet, to help diagnose problems with its server and to administer the Website. If you prefer not to accept a cookie, you can set your web browser to warn you before accepting cookies, or you can refuse all cookies by turning them off in your web browser.

The Firm is committed to ensuring the security of your Personal Data. The Firm takes appropriate commercially reasonable technical, physical and organisational measures to prevent unauthorised or unlawful processing of your Personal Data or accidental loss or destruction of your Personal Data. The Firm will ensure a level of security suitable to the identified risks and pursuant to applicable data protection laws.

Employees of the Firm are trained to handle Personal Data securely and with utmost respect and they will treat your Personal Data in a strictly confidential manner. Staff members shall be authorized to access Personal Data only to the extent necessary to serve the applicable legitimate purposes for which the data are processed by the Firm and to perform their job.

The Firm will not divulge client information to a third party unless it has received explicit client authorisation, or it has been required to do so by law.

The Firm may update this Notice from time to time. The Firm advises you to periodically review this Notice to stay informed about privacy practices.

If you have any questions, concerns or complaints with respect to this Notice, the way the Firm is handling your privacy or you wish to exercise any of your rights, please contact info@cw.partners.