Privacy Policy

1. About this policy and who we are

Shallon Legal FZ LLC (“Shallon Legal”, “we”, “us” or “our”) is an independent legal and corporate services firm established in Fujairah Creative City free zone, United Arab Emirates. We provide legal, fiduciary and corporate services, including Wills, succession and estate planning, trusts and foundations, company formation and corporate administration, dispute resolution, and regulatory and compliance advisory.

We are the controller of the personal data we process in connection with our services and our website. This policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, how we protect it, and the rights available to you. Please read it carefully.

Our primary data protection law is the United Arab Emirates Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the “PDPL”). Where we offer services to, or monitor the behaviour of, individuals located in the European Union or the United Kingdom, we also comply with the applicable General Data Protection Regulation in respect of that processing, as explained in section 13.

2. Who this policy applies to

This policy applies to the personal data of clients and prospective clients; individuals connected to a client or a matter, such as family members, beneficiaries, settlors, protectors, shareholders, directors, officers and guardians named in a Will or structure; individuals we deal with in providing our services, such as counterparties and professional contacts; visitors to our website; and our suppliers and service providers.

3. The personal data we collect

Identity and contact data, such as your name, date of birth, nationality, identification documents (including passport and Emirates ID), address, email address and telephone number.

Due diligence and compliance data that we collect to meet our anti-money laundering and know-your-client obligations, including identification and verification documents, source of funds and source of wealth information, and the results of sanctions, politically exposed person and adverse-media screening.

Information relevant to your instructions. For Wills and succession this includes your assets, your family circumstances, and the beneficiaries, executors and guardians you name. For trusts and foundations this includes settlors, beneficiaries, protectors and assets. For company formation and corporate services this includes shareholders, directors, officers and ownership information. For disputes this includes the information relevant to the matter.

Financial and transactional data necessary to provide our services and to invoice and receive payment.

Records of our communications with you, which may be monitored or recorded for quality, security and compliance purposes.

Website and technical data, including your IP address, device and browser information and cookie data, as described in section 12.

Sensitive personal data, in limited circumstances. This may include information revealing religion where it is relevant to succession, and information about criminal records or alleged offences arising from sanctions and screening. Where you appoint guardians for, or provide for, your children, we process children’s personal data. We treat such data with additional care and process it only where a lawful basis applies.

4. How we collect your personal data

We collect personal data directly from you; from persons acting on your behalf or otherwise connected to your matter; from publicly available sources and registers, including company registries, court records and insolvency registers; from sanctions and screening service providers; and through your use of our website.

5. Why we use your personal data and our lawful basis

The PDPL requires us to have a lawful basis for each use of your personal data. We rely on the following bases:

• the performance of a contract with you, or steps taken at your request before entering into a contract, in order to provide our services;
• compliance with our legal and regulatory obligations, including anti-money laundering, counter-terrorist financing, know-your-client, sanctions and record-keeping requirements;
• our legitimate business interests in operating, administering, protecting and developing our firm, where these are not overridden by your rights and interests;
• the establishment, exercise or defence of legal claims;

your consent, where we ask for it, for example for certain marketing communications; and

the protection of vital interests or the public interest, in the limited circumstances recognised by the PDPL.

Where we process sensitive personal data, we do so only where an additional basis applies, such as your explicit consent, the establishment, exercise or defence of legal claims, or compliance with a legal obligation in the substantial public interest, such as the prevention and detection of financial crime.

We use your personal data to provide our legal, fiduciary and corporate services; to meet our compliance obligations; to make filings and registrations with courts, registries and authorities where you instruct us, including, where relevant, the DIFC Wills Service and the DIFC and ADGM Courts; to communicate with you and handle any complaint; to administer, protect and improve our firm; and, with your consent, to send you updates about our services.

6. Who we share your personal data with

We do not sell your personal data. We share it only where we have a proper basis to do so, and only with the following categories of recipient:

• courts, tribunals, registries and authorities where necessary for your matter or where required by law, including, where you instruct us, wills registries and the courts;
• banks and financial institutions where you instruct us to assist with an introduction or an account;
• our regulators, and law-enforcement, tax and other governmental authorities, where required;
• sanctions, screening and fraud-prevention providers;
• professional advisers, including lawyers, accountants, auditors and tax advisers;

service providers who process personal data on our behalf under contract, such as IT, cloud, document-management and communications providers, who act on our instructions and are bound by confidentiality and data-protection obligations; and

a purchaser or successor, in connection with a sale or reorganisation of our business.

7. Sending information outside the UAE

Some of our service providers are located outside the United Arab Emirates, so your personal data may be transferred abroad. Under the PDPL, we transfer personal data outside the UAE only where the destination provides an adequate level of protection, or where appropriate safeguards are in place, such as contractual protections, or where another basis permitted by the PDPL applies, including your consent or the performance of your contract. Details of our transfers are available on request.

8. How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes described in this policy, and to meet our legal, regulatory and professional obligations, including anti-money laundering record-keeping and the periods during which legal claims may be brought. When we no longer need it, we delete or anonymise it.

9. Keeping your personal data secure

We maintain appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption of data in transit, secure storage and confidentiality obligations on our people. If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify the UAE Data Office and, where required, you, without undue delay.

10. Your rights

Subject to the conditions and exceptions in the PDPL, you have the right to be informed about our processing; to access the personal data we hold about you; to have inaccurate data corrected; to have your data erased in certain circumstances; to restrict or object to processing; to request that we stop processing; to receive certain data in a portable form; and to withdraw your consent where we rely on it.

We may not always be able to comply with a request in full, for example where we are required to retain data to meet a legal or regulatory obligation, and we will explain to you if that is the case. To exercise a right, please contact us using the details in section 14. We may need to verify your identity first, and we do not usually charge.

11. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Where we use screening tools for compliance purposes, the results are reviewed by our people.

12. Cookies and website analytics

Our website uses cookies and similar technologies to help it function and to understand how visitors use it. Some of this data, including your IP address, is personal data.

We use analytics services, which may include Google Analytics, that set cookies and process technical data about your visit in order to compile reports on website usage. Where required, we rely on your consent for non-essential cookies, which you can manage or withdraw through your browser settings or our cookie controls.

13. Individuals in the European Union and the United Kingdom

We are established in the United Arab Emirates and our primary data protection law is the PDPL. Where we offer services to, or monitor the behaviour of, individuals located in the European Union or the United Kingdom, we comply with the EU General Data Protection Regulation or the UK General Data Protection Regulation, as applicable, in respect of that processing, including by honouring the rights those laws provide and by applying appropriate safeguards to any international transfer.

14. Contacting us and complaints

If you have any question about this policy, or you wish to exercise your rights, please contact our data protection contact at Shallon Legal FZ LLC, Office 2002, 20th Floor, Creative Tower, PO Box 4422, Fujairah, United Arab Emirates, by email at data@shalloncsp.com.

If you are not satisfied with how we have handled your personal data, you may complain to the UAE Data Office, the federal supervisory authority established under Federal Decree-Law No. 44 of 2021. Individuals in the European Union or the United Kingdom may also complain to their local supervisory authority.

15. Changes to this policy

We may update this policy from time to time. The current version is published on our website, and we will indicate when it was last updated.