1. Who we are and how to contact us

Cliveden Holding Limited (registration number CL14139) is incorporated in the Dubai International Financial Centre (DIFC), with its registered office at Innovation One, Level 2 (“Cliveden”, “we” or “us”). We are the controller of the personal data described in this statement, meaning we decide why and how it is used.

For questions about this statement or to exercise your data protection rights, contact our

Data Protection Contact: Business Unit Manager
Email: info@clivedencapital.com
Telephone: +971 50 921 0477

This statement covers website visitors, people who contact us, clients and prospective clients, suppliers and business contacts.

2. Personal data we collect and its sources

Information you provide or we create through our dealings: name, job title, organisation, contact details, correspondence and notes of calls or meetings; information required to provide our services, which may include income, assets and financial position; and identification documents and verification or screening results where required.
Information from other sources: your organisation, representatives or advisers; public sources such as company registers, websites and sanctions lists; and verification and screening providers.
Website and technical information: IP address, browser and device type, pages visited and cookie data collected through our website and supporting providers (see section 7).

Sensitive information. We do not routinely request special categories of personal data and ask you not to provide such information unless requested. Where necessary, we process it only where both a lawful basis and an applicable condition for processing special categories of personal data are satisfied under the DIFC Data Protection Law.

3. How and why we use your personal data

Purpose	Basis for processing
Responding to your enquiries	Our legitimate interests / steps at your request
Providing and administering our services	Performance of a contract
Operating, securing and improving this website	Our legitimate interests
Complying with legal and regulatory obligations	Legal obligation

Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, by contacting us or using the relevant settings. Withdrawing consent does not affect the lawfulness of what we did before you withdrew it.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

4. Who we share your personal data with

We do not sell personal data or disclose it to third parties for their own direct marketing. Where necessary for the purposes described in this statement, we share it with:

other Cliveden group companies for internal administration and relationship management;
IT, hosting, email, analytics, screening and other service providers acting on our instructions under written data protection arrangements;
professional advisers, including lawyers, auditors, accountants and insurers;
banks, financial institutions and counterparties where needed to provide our services;
courts, regulators, law enforcement and other authorities where legally required or permitted, after appropriate checks on the validity and proportionality of the request;
prospective buyers or investors and their advisers in a sale or restructuring, subject to appropriate confidentiality and data protection safeguards; and
others where you instruct us or consent to the disclosure.

5. International transfers

Your personal data may be transferred to, or accessed from, outside the DIFC, including the United Kingdom, UAE Mainland, Germany and other jurisdictions where Cliveden or its service providers operate. We make these transfers only as permitted by the DIFC Data Protection Law: to destinations recognised by the Commissioner as providing adequate protection; subject to appropriate safeguards, such as Commissioner-approved standard contractual clauses; or under another applicable lawful transfer mechanism or derogation.

6. How long we keep your personal data

We retain personal data only as long as necessary for the purposes described in this statement, taking account of legal and contractual requirements, relevant limitation periods and our relationship with you. As a general guide, enquiries that do not lead to a relationship are kept for up to two years after our last contact, and client records for the relationship and six years afterwards. A different period may apply where required by applicable law or necessary to resolve a dispute, investigation or legal claim.

When no longer needed, personal data is securely deleted, destroyed or anonymised. Data awaiting deletion from backups remains protected and is not used for other purposes.

7. Cookies

We use essential, analytics and marketing cookies. Essential cookies support the operation and security of our website. Analytics cookies help us understand website use, and marketing cookies support relevant advertising and measurement. Non-essential cookies are used only with your consent, which you may refuse or withdraw at any time. You can choose which cookies to allow using the Cookie Preferences tab at the bottom of every page, and you can change your choice there at any time.

8. Your rights and direct marketing

Subject to the conditions and exceptions in the DIFC Data Protection Law, you have the right to:

be informed about processing and access your personal data, including receiving a copy and information about its use and disclosure;
have inaccurate data corrected or incomplete data completed;
request erasure or restriction of processing where the legal conditions are met;
object to processing based on legitimate interests on grounds relating to your particular situation;
object at any time to direct marketing and related profiling;
withdraw consent where processing relies on it;
receive data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another organisation where technically feasible, if processing is automated and based on consent or contract;
not be subject to solely automated decisions with legal or similarly significant effects, subject to statutory exceptions and safeguards, including human review where applicable; and
not be treated less favourably for exercising your rights.

Exercising your rights. Contact the Data Protection Lead using the details in section 1; no account is required. We respond without undue delay and within one month. Where permitted because of the complexity or number of requests, we may extend this by up to two further months and will explain the extension within the first month. We may need proportionate information to verify your identity. Requests are normally free, but manifestly unfounded or excessive requests may be refused or incur a reasonable fee as permitted by law. If we cannot fulfil a request, we will explain why and tell you about your complaint and judicial remedy options.

Direct marketing. We may send business contacts information about our services based on our legitimate interest in promoting our business, or consent where required by applicable law. You may opt out at any time using the instructions in each message or the contact details in section 1. We will stop using your data for direct marketing when you object.

9. Security and data breaches

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure, including access controls, confidentiality commitments and provider security checks. Where a personal data breach compromises your confidentiality, security or privacy, we notify the DIFC Commissioner of Data Protection as soon as practicable, as required by law. Where a breach is likely to result in a high risk to your security or rights, we also notify you as soon as practicable, subject to applicable legal exceptions.

10. Complaints and remedies

If you have a concern, please contact us using section 1 so we can try to resolve it. You may complain directly to the DIFC Commissioner of Data Protection at any time; you do not need to contact us first.

Commissioner of Data Protection
Dubai International Financial Centre Authority

Level 14, The Gate Building, DIFC, Dubai, UAE

Telephone: +971 4 362 2222
Email: commissioner@dp.difc.ae

You may also seek judicial remedies through the DIFC Courts, including compensation where the legal conditions are met.

11. Changes to this statement

We may update this statement from time to time. The current version is published on this page with its last-updated date. We will provide further notice of material changes where required by law, including before using personal data for a new purpose where applicable.