Data Privacy Notice
Your personal data – what is it?
Personal data is any information that enables us to identify you, either directly or indirectly in conjunction with any other information we hold, by reference to an identifier such as name, address, date of birth or government identification number. Personal data can also be information about your actions and behaviour (for example, risk tolerance or transaction history). The processing of personal data is governed by the DIFC Law No. 5 of 2020 on Data Protection (“DIFC DPL”), the DIFC Data Protection Regulations and any legally binding regulations, directions and orders issued from time to time under or in connection with the DIFC DPL) .
Who are we?
Equities First Holdings Hong Kong Ltd (DIFC Representative Office) (“EFH UAE”) is based in the Dubai International Financial Centre (“DIFC”), United Arab Emirates and is a representative office of Equities First Holdings Hong Kong Limited based in Hong Kong]. EFH UAE is authorized and regulated by the Dubai Financial Services Authority (Registration Number: 7354) and is the data controller. This means that we decide and control how your personal data is processed, and for what purposes.
Data is shared with EFH in the USA in order for them to consider entering a loan contract with you, and due to the nature of their involvement EFH will also be a data controller with respect to your personal data. EFH may share some of these records within its group in order to complete the administration processes. To ensure that your personal data is adequately protected when it is shared, we have put in place European Commission/DIFC Commissioner of Data Protection-approved Standard Contractual Clauses that comply with the law on data transfers. For more information or to request a copy of the Standard Contractual Clauses, please contact the Data Protection Officer, Amy Webster.
Our registered offices are located at Gate Precinct Building 4, 6th Floor, Office 7, Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates (Company No. CL7354).
How do we process your personal data?
EFH UAE complies with its obligations under the DIFC DPL by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
We will use your personal data for the following purposes:
- To confirm your identity
- To generate and administer your loan contract
- To respond to your questions and to provide customer services
- To detect and prevent fraud or any other financial crimes
- To monitor and protect the security of our information, systems, and network
- For internal business intelligence purposes, product enhancements, and developments
- To inform you of changes made to our services
- To conduct marketing and commercial activities
- To market relevant offers and promotions to you
What is the legal basis for processing your personal data?
Under Article 10(b) of the DIFC DPL, the legal basis that EFH UAE employs for processing your personal data is that processing of your personal data is necessary for the performance of a loan contract to which you, the ‘data subject’ is party, or in order to take steps at your request prior to entering into such a contract.
We also process your personal data under Article 10(f) of the DIFC DPL where processing is necessary for the purposes of our legitimate commercial interests, except where such interests are overridden by your rights and interests.
Sharing your personal data
Your personal data will be treated as being strictly confidential. We may share your personal data with the parties set out below to generate and administer your loan contract or for the purposes set out in this Data Privacy Notice:
- EFH in the USA who are responsible for generating the documentation and relevant terms and conditions for any loans that might be provided to you.
- Companies that provide services to help us confirm your identity, meet our compliance and regulatory obligations, and to detect and prevent fraud or other financial crime;
- Our professional advisors such as auditors, accountants, lawyers, etc.
- Companies that provide services to help us with our business activities such as data storage, maintenance services, database management and payment processing.
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Data Privacy Notice.
We may also disclose your personal data as required by law, such as to comply with a court order, or a similar legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request, and to any other third party with your prior consent to do so, unless notification is prohibited by the applicable law.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Where personal data is shared with a third party located outside the DIFC that has not received an adequacy decision by the DIFC Commissioner of Data Protection, we rely on appropriate safeguards.
All the personal data that we hold about you will be processed by our staff in the United Arab Emirates and within the EFH Group for administration purposes. Please be aware that your personal data will be stored on a cloud-based system.
How long do we keep your personal data for?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements, after which time it will be destroyed securely if it is no longer needed for the lawful purposes for which it was obtained. In some limited cases, it may be necessary to retain your personal data for longer if we need to hold it for liability claim purposes (e.g. if any complaints were to be made to the Dubai Financial Services Authority), and for example to hold and provide to our regulatory body in the DIFC, the Dubai Financial Services Authority. If you consent to receive marketing from us, any information we use for this purpose will be held by us until such time as you notify us that you no longer wish to receive marketing information from us.
Your rights and your personal data
Unless subject to an exemption under the DIFC DPL, you may have the following rights with respect to your personal data:
- to request a copy of your personal data which EFH UAE holds about you;
- to request that EFH UAE corrects any of your personal data if it is found to be inaccurate or out of date;
- to request your personal data to be erased where it is no longer necessary for EFH UAE to retain such data;
- to withdraw your consent to the processing of your personal data at any time (where we have asked you for consent to use your information for a particular purpose);
- to request that EFH UAE provides you with your personal data, and where possible, to transmit the data directly to another data controller (known as the right to data portability);
- where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- to object to the processing of your personal data at any time including where such processing based exclusively on our legitimate interests, or with regards to Direct Marketing;
- to lodge a complaint with a competent data protection authority, for example, the DIFC Commissioner of Data Protection.
If you wish to exercise any of the above rights, please email or write to us at the addresses provided in the ‘Contact Details’ section of this Data Privacy Notice.
Access to your information and correction
You have the right to request a copy of the information that we hold about you. If you would like a copy of all or some of your personal data, please email or write to us at the addresses provided in the “Contact Details” section of this Data Privacy Notice. In some exceptional cases, we may make a small charge for this service (for example multiple claims for the same information), but usually this data will be provided free of charge.
We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
Marketing
We would like to send you information about products and services of ours and other companies within our group which may be of interest to you. If you have consented to receive marketing, you may opt out at a later date.
You have a right at any time to stop us from contacting you for marketing purposes or giving your information to other entities within our group. If you no longer wish to be contacted for marketing purposes, please email or write to us at the addresses provided in the ‘Contact Details’ section of this Data Privacy Notice.
Automated Decision Making
We do not use automated decision making to segment and target product offers based on our customers’ demands and needs. For further details, you may contact our Data Protection Officer whose details are provided in the ‘Contact Details’ section of this Data Privacy Notice.
Further processing
If we wish to use your personal data for a new purpose, not defined by this Data Privacy Notice, then we will provide you with a new notice explaining this new use prior to the commencement of the new processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
Contact Details
To exercise all relevant rights, or to raise queries or complaints, please in the first instance contact the Data Protection Officer, Amy Webster.
By email:
By post:
The Data Protection Officer
Gate Precinct Building 4, 6th Floor, Office 7,
Dubai International Financial Centre, Dubai, United Arab Emirates
You can contact the DIFC Commissioner of Data Protection via the DIFC switchboard at +97143622222 or via email at commissioner@dp.difc.ae.
