This policy explains how Fujairah Capital Corporation and its related bodies corporate (Fujairah Capital Corporation, we, us or our) collect, hold, use and disclose (collectively, process) and protect personal information. Employees and prospective employees should refer to the Human Resources Privacy Policy.

For the purposes of the UK GDPR and UAE PDPL, Fujairah Capital Corporation is the Data Controller of your personal information.

References to "you" or "your" refers to individuals whose personal information is processed by the Fujairah Capital Corporation.

We recognise each individual's right to privacy and are committed to the protection and confidentiality of your personal information.

WHAT PERSONAL INFORMATION DO WE COLLECT?

Personal information is information relating to an individual, which can be used either alone or with other sources of information to identify that individual.

The types of personal information that we collect depends on our relationship with you, and may include:

• Identification data (full name, title, date of birth, passport number, driver's licence number, tax identifiers, signature);
• Contact data (personal address, telephone number, email address);
• Electronic Monitoring data (to the extent permitted by law, we may record and monitor your electronic communications with us);
• Financial data (bank account number);
• Marketing and Communications data (preferences, tracking data relating to whether you have read marketing communications from us);
• Professional Information data (position/job title, work address, telephone number, email address);
• Profile data (username and password for our online services, investments made by you, services requested, marketing communications responded to, survey responses);
• Services data (payment details, services you have provided to us or we have provided to you).

Sensitive Information

We do not knowingly collect personal data from children. If you are under 18 in the UAE or under 13 in the UK, you must have parental or guardian consent.

Sensitive personal information includes information relating to race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions or associations, trade union membership, information about health, genetic, or biometric data.

We only process such sensitive personal data where:

• You have given us explicit consent; or
• Processing is necessary for reasons of substantial public interest or compliance with legal obligations.

In limited circumstances, and where allowed by law, we may also collect information about:

• Criminal convictions and offences, when legally required;
• Political affiliations where required to determine whether you are a politically exposed person.

HOW DO WE COLLECT PERSONAL INFORMATION?

We collect personal information in a number of ways:

• When you or your representatives provide (or update) information for our services;
• From organisations or entities that you represent;
• Through your use of our website;
• From publicly available information.

Unsolicited personal information will be handled in accordance with applicable law. Where it is not lawful to retain it, we will take reasonable steps to destroy or de-identify it.

LEGAL BASES FOR PROCESSING

We process your personal information on the following legal bases (UK GDPR, Article 6; UAE PDPL, Articles 4-6):

COLLECTING THROUGH OUR WEBSITE

• Web analytics: Collected in anonymised form to improve your experience.
• Cookies: In the UK and UAE, we will seek your consent before placing non-essential cookies.
• Email lists and feedback: We collect information when you sign up or provide feedback, based on your consent.
• Social networking services: When engaging via LinkedIn or similar, your data is collected in line with that platform's privacy policies.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We process your personal information for:

• Delivering services;
• Managing our business operations;
• Compliance with legal and regulatory obligations;
• Marketing (with consent);
• Security, fraud prevention, and risk management.

DIRECT MARKETING

We may use your personal information to communicate with you about products and services offered by us or affiliated investment managers. You can withdraw consent at any time.

WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

We may disclose your personal information to:

• External service providers (e.g., IT, auditors, administrators);
• Affiliated investment managers (with your consent);
• Authorised representatives;
• Regulatory or enforcement authorities;
• Other parties as required by law.

Data Transfers

Where we transfer personal information outside the UK or UAE (including to Australia), we will ensure:

• UK: Use of Standard Contractual Clauses (SCCs) or equivalent safeguards;
• UAE: Adequacy decisions, appropriate contractual measures, or explicit consent.

DATA QUALITY AND SECURITY

We take reasonable steps to ensure your personal data is accurate, up-to-date, and protected against loss, misuse, unauthorised access, or disclosure. Measures include ICT safeguards, access controls, staff training, and audit trails.

All personal information is currently stored on cloud servers, subject to binding contractual and security protections.

DATA RETENTION

We retain your personal information for as long as necessary for the purposes described above or as required by law. Examples:

• Client onboarding records: 7 years after relationship ends (financial regulations);
• Marketing data: until consent is withdrawn;
• Website logs: up to 2 years.

After expiry, data will be securely deleted or anonymised.

YOUR RIGHTS

You have the following rights:

• Access -- to obtain a copy of your personal data.
• Correction -- to rectify incomplete or inaccurate data.
• Erasure -- to request deletion of your data where no legal grounds apply.
• Restriction -- to limit processing in specific circumstances.
• Portability -- to request transfer of data in a machine-readable format.
• Object -- to object to processing, including direct marketing.
• Withdraw Consent -- at any time, without affecting prior lawful processing.
• Automated Decision-Making -- to request human review if decisions with legal or significant effects are made solely by automated means. Currently, we do not use automated decision-making or profiling.

Supervisory Authorities

• UK: Information Commissioner's Office (ICO), www.ico.org.uk
• UAE: UAE Data Office, www.dataoffice.gov.ae

You may lodge complaints directly with these authorities.

CHILDREN'S DATA

Our services are not directed to children. We do not knowingly process data of children without parental/guardian consent. Where required, we comply with the UK Age Appropriate Design Code.

HOW TO CONTACT US

Privacy Officer
By email: enquiries@fcc.ae
By phone: +971 (0) 920 14777

ACCEPTANCE AND CHANGES

We may update this Privacy Policy from time to time. Updates will be published on our website, with the "last updated" date displayed.